@hexclave/shared-backend 1.0.17

package/LICENSE

@@ -0,0 +1,5 @@
+Stack is licensed per-package, and 100% open-source.
+
+Generally speaking, client code and examples are licensed under an open-source MIT license, while server components are licensed under an open-source AGPLv3 license. Please refer to each package's `LICENSE` files for more information.
+
+We also have enterprise licenses available, if you prefer; please contact [enterprise@hexclave.com](mailto:enterprise@hexclave.com).

package/dist/chunk-BE-pF4vm.js

@@ -0,0 +1,34 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") {
+		for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+			key = keys[i];
+			if (!__hasOwnProp.call(to, key) && key !== except) {
+				__defProp(to, key, {
+					get: ((k) => from[k]).bind(null, key),
+					enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+				});
+			}
+		}
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+
+//#endregion
+
+Object.defineProperty(exports, '__toESM', {
+  enumerable: true,
+  get: function () {
+    return __toESM;
+  }
+});

package/dist/config-agent.d.ts

@@ -0,0 +1,42 @@
+//#region src/config-agent.d.ts
+type ClaudeAgentToolName = "Read" | "Write" | "Edit" | "MultiEdit" | "NotebookEdit" | "Bash" | "Glob" | "Grep";
+type ClaudeAgentHookResult = {
+  continue: true;
+} | {
+  hookSpecificOutput: {
+    hookEventName: "PreToolUse";
+    permissionDecision: "deny";
+    permissionDecisionReason: string;
+  };
+};
+type ClaudeAgentPreToolUseInput = {
+  hook_event_name: "PreToolUse";
+  tool_name: string;
+  tool_input: unknown;
+};
+type RunClaudeAgentOptions = {
+  prompt: string;
+  cwd: string;
+  allowedTools: ClaudeAgentToolName[];
+  timeoutMs?: number;
+  strictIsolation?: boolean;
+  stderr?: (data: string) => void;
+  onMessage?: (message: unknown) => void;
+  onPreToolUse?: (input: ClaudeAgentPreToolUseInput) => Promise<ClaudeAgentHookResult> | ClaudeAgentHookResult;
+};
+type RunClaudeAgentResult = {
+  resultText: string;
+};
+declare class ClaudeAgentTimeoutError extends Error {
+  constructor(timeoutMs?: number);
+}
+declare class ClaudeAgentFailureError extends Error {
+  constructor(subtype: string);
+}
+declare function stripClaudeCodeEnv(): Record<string, string | undefined>;
+declare function runHeadlessClaudeAgent(options: RunClaudeAgentOptions): Promise<RunClaudeAgentResult>;
+declare function getToolWriteTargetPath(toolName: string, toolInput: unknown, cwd: string): string | null;
+declare function isPathInsideDir(dir: string, target: string): boolean;
+//#endregion
+export { ClaudeAgentFailureError, ClaudeAgentPreToolUseInput, ClaudeAgentTimeoutError, ClaudeAgentToolName, RunClaudeAgentOptions, RunClaudeAgentResult, getToolWriteTargetPath, isPathInsideDir, runHeadlessClaudeAgent, stripClaudeCodeEnv };
+//# sourceMappingURL=config-agent.d.ts.map

package/dist/config-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-agent.d.ts","names":[],"sources":["../src/config-agent.ts"],"mappings":";KAMY,mBAAA;AAAA,KAEP,qBAAA;EAA0B,QAAA;AAAA;EAC7B,kBAAA;IACE,aAAA;IACA,kBAAA;IACA,wBAAA;EAAA;AAAA;AAAA,KAIQ,0BAAA;EACV,eAAA;EACA,SAAA;EACA,UAAA;AAAA;AAAA,KAGU,qBAAA;EACV,MAAA;EACA,GAAA;EACA,YAAA,EAAc,mBAAA;EACd,SAAA;EACA,eAAA;EACA,MAAA,IAAU,IAAA;EACV,SAAA,IAAa,OAAA;EACb,YAAA,IAAgB,KAAA,EAAO,0BAAA,KAA+B,OAAA,CAAQ,qBAAA,IAAyB,qBAAA;AAAA;AAAA,KAG7E,oBAAA;EACV,UAAA;AAAA;AAAA,cAGW,uBAAA,SAAgC,KAAA;cAC/B,SAAA;AAAA;AAAA,cAMD,uBAAA,SAAgC,KAAA;cAC/B,OAAA;AAAA;AAAA,iBAUE,kBAAA,CAAA,GAAsB,MAAA;AAAA,iBAOhB,sBAAA,CAAuB,OAAA,EAAS,qBAAA,GAAwB,OAAA,CAAQ,oBAAA;AAAA,iBA0EtE,sBAAA,CAAuB,QAAA,UAAkB,SAAA,WAAoB,GAAA;AAAA,iBAO7D,eAAA,CAAgB,GAAA,UAAa,MAAA"}

package/dist/config-agent.js

@@ -0,0 +1,96 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('./chunk-BE-pF4vm.js');
+let _anthropic_ai_claude_agent_sdk = require("@anthropic-ai/claude-agent-sdk");
+let path = require("path");
+path = require_chunk.__toESM(path);
+
+//#region src/config-agent.ts
+const ANTHROPIC_PROXY_BASE_URL = process.env.STACK_CLAUDE_PROXY_URL ?? "https://api.hexclave.com/api/v1/integrations/ai-proxy";
+var ClaudeAgentTimeoutError = class extends Error {
+	constructor(timeoutMs) {
+		super(`Claude agent timed out${timeoutMs == null ? "" : ` after ${timeoutMs}ms`}.`);
+		this.name = "ClaudeAgentTimeoutError";
+	}
+};
+var ClaudeAgentFailureError = class extends Error {
+	constructor(subtype) {
+		super(`Claude agent failed (${subtype}).`);
+		this.name = "ClaudeAgentFailureError";
+	}
+};
+function isAbortError(error) {
+	return error instanceof Error && error.name === "AbortError";
+}
+function stripClaudeCodeEnv() {
+	const env = { ...process.env };
+	delete env.CLAUDECODE;
+	return env;
+}
+async function runHeadlessClaudeAgent(options) {
+	const abortController = new AbortController();
+	const timeout = options.timeoutMs == null ? null : setTimeout(() => abortController.abort(), options.timeoutMs);
+	let sawResult = false;
+	let resultText = "";
+	const onPreToolUse = options.onPreToolUse;
+	try {
+		for await (const message of (0, _anthropic_ai_claude_agent_sdk.query)({
+			prompt: options.prompt,
+			options: {
+				model: "nvidia/nemotron-3-super-120b-a12b:nitro",
+				...options.strictIsolation === true ? {
+					settingSources: [],
+					strictMcpConfig: true
+				} : {},
+				...onPreToolUse == null ? {} : { hooks: { PreToolUse: [{ hooks: [async (input) => {
+					if (input.hook_event_name !== "PreToolUse") return { continue: true };
+					return await onPreToolUse(input);
+				}] }] } },
+				allowedTools: options.allowedTools,
+				permissionMode: "dontAsk",
+				cwd: options.cwd,
+				abortController,
+				env: {
+					...stripClaudeCodeEnv(),
+					...options.strictIsolation === true ? { CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1" } : {},
+					ANTHROPIC_BASE_URL: ANTHROPIC_PROXY_BASE_URL,
+					ANTHROPIC_API_KEY: "stack-auth-proxy"
+				},
+				stderr: options.stderr
+			}
+		})) {
+			options.onMessage?.(message);
+			if (message.type === "result") if ("result" in message) {
+				sawResult = true;
+				resultText = message.result;
+			} else throw new ClaudeAgentFailureError(message.subtype);
+		}
+	} catch (error) {
+		if (abortController.signal.aborted && isAbortError(error)) throw new ClaudeAgentTimeoutError(options.timeoutMs ?? void 0);
+		throw error;
+	} finally {
+		if (timeout != null) clearTimeout(timeout);
+	}
+	if (!sawResult) throw new Error("Claude agent ended without reporting a result.");
+	return { resultText };
+}
+const FILE_MUTATING_TOOLS = new Set(["Write", "Edit"]);
+function hasStringFilePath(input) {
+	return typeof input === "object" && input !== null && "file_path" in input && typeof input.file_path === "string";
+}
+function getToolWriteTargetPath(toolName, toolInput, cwd) {
+	if (!FILE_MUTATING_TOOLS.has(toolName) || !hasStringFilePath(toolInput)) return null;
+	return path.default.isAbsolute(toolInput.file_path) ? toolInput.file_path : path.default.resolve(cwd, toolInput.file_path);
+}
+function isPathInsideDir(dir, target) {
+	const relative = path.default.relative(path.default.resolve(dir), path.default.resolve(target));
+	return relative === "" || !relative.startsWith("..") && !path.default.isAbsolute(relative);
+}
+
+//#endregion
+exports.ClaudeAgentFailureError = ClaudeAgentFailureError;
+exports.ClaudeAgentTimeoutError = ClaudeAgentTimeoutError;
+exports.getToolWriteTargetPath = getToolWriteTargetPath;
+exports.isPathInsideDir = isPathInsideDir;
+exports.runHeadlessClaudeAgent = runHeadlessClaudeAgent;
+exports.stripClaudeCodeEnv = stripClaudeCodeEnv;
+//# sourceMappingURL=config-agent.js.map

package/dist/config-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-agent.js","names":[],"sources":["../src/config-agent.ts"],"sourcesContent":["import { query } from \"@anthropic-ai/claude-agent-sdk\";\nimport path from \"path\";\n\nconst DEFAULT_PROXY_URL = \"https://api.hexclave.com/api/v1/integrations/ai-proxy\";\nconst ANTHROPIC_PROXY_BASE_URL: string = process.env.STACK_CLAUDE_PROXY_URL ?? DEFAULT_PROXY_URL;\n\nexport type ClaudeAgentToolName = \"Read\" | \"Write\" | \"Edit\" | \"MultiEdit\" | \"NotebookEdit\" | \"Bash\" | \"Glob\" | \"Grep\";\n\ntype ClaudeAgentHookResult = { continue: true } | {\n  hookSpecificOutput: {\n    hookEventName: \"PreToolUse\",\n    permissionDecision: \"deny\",\n    permissionDecisionReason: string,\n  },\n};\n\nexport type ClaudeAgentPreToolUseInput = {\n  hook_event_name: \"PreToolUse\",\n  tool_name: string,\n  tool_input: unknown,\n};\n\nexport type RunClaudeAgentOptions = {\n  prompt: string,\n  cwd: string,\n  allowedTools: ClaudeAgentToolName[],\n  timeoutMs?: number,\n  strictIsolation?: boolean,\n  stderr?: (data: string) => void,\n  onMessage?: (message: unknown) => void,\n  onPreToolUse?: (input: ClaudeAgentPreToolUseInput) => Promise<ClaudeAgentHookResult> | ClaudeAgentHookResult,\n};\n\nexport type RunClaudeAgentResult = {\n  resultText: string,\n};\n\nexport class ClaudeAgentTimeoutError extends Error {\n  constructor(timeoutMs?: number) {\n    super(`Claude agent timed out${timeoutMs == null ? \"\" : ` after ${timeoutMs}ms`}.`);\n    this.name = \"ClaudeAgentTimeoutError\";\n  }\n}\n\nexport class ClaudeAgentFailureError extends Error {\n  constructor(subtype: string) {\n    super(`Claude agent failed (${subtype}).`);\n    this.name = \"ClaudeAgentFailureError\";\n  }\n}\n\nfunction isAbortError(error: unknown): boolean {\n  return error instanceof Error && error.name === \"AbortError\";\n}\n\nexport function stripClaudeCodeEnv(): Record<string, string | undefined> {\n  const env = { ...process.env };\n  // CLAUDECODE must be unset for nested agents; ANTHROPIC_API_KEY must be non-empty (proxy ignores it).\n  delete env.CLAUDECODE;\n  return env;\n}\n\nexport async function runHeadlessClaudeAgent(options: RunClaudeAgentOptions): Promise<RunClaudeAgentResult> {\n  const abortController = new AbortController();\n  const timeout = options.timeoutMs == null ? null : setTimeout(() => abortController.abort(), options.timeoutMs);\n  let sawResult = false;\n  let resultText = \"\";\n  const onPreToolUse = options.onPreToolUse;\n  try {\n    for await (const message of query({\n      prompt: options.prompt,\n      options: {\n        model: \"nvidia/nemotron-3-super-120b-a12b:nitro\",\n        ...(options.strictIsolation === true ? {\n          settingSources: [],\n          strictMcpConfig: true,\n        } : {}),\n        ...(onPreToolUse == null ? {} : {\n          hooks: {\n            PreToolUse: [{\n              hooks: [async (input) => {\n                if (input.hook_event_name !== \"PreToolUse\") {\n                  return { continue: true };\n                }\n                return await onPreToolUse(input);\n              }],\n            }],\n          },\n        }),\n        allowedTools: options.allowedTools,\n        permissionMode: \"dontAsk\",\n        cwd: options.cwd,\n        abortController,\n        env: {\n          ...stripClaudeCodeEnv(),\n          ...(options.strictIsolation === true ? { CLAUDE_CODE_DISABLE_AUTO_MEMORY: \"1\" } : {}),\n          ANTHROPIC_BASE_URL: ANTHROPIC_PROXY_BASE_URL,\n          ANTHROPIC_API_KEY: \"stack-auth-proxy\",\n        },\n        stderr: options.stderr,\n      },\n    })) {\n      options.onMessage?.(message);\n      if (message.type === \"result\") {\n        if (\"result\" in message) {\n          sawResult = true;\n          resultText = message.result;\n        } else {\n          throw new ClaudeAgentFailureError(message.subtype);\n        }\n      }\n    }\n  } catch (error) {\n    if (abortController.signal.aborted && isAbortError(error)) {\n      throw new ClaudeAgentTimeoutError(options.timeoutMs ?? undefined);\n    }\n    throw error;\n  } finally {\n    if (timeout != null) {\n      clearTimeout(timeout);\n    }\n  }\n  if (!sawResult) {\n    throw new Error(\"Claude agent ended without reporting a result.\");\n  }\n  return { resultText };\n}\n\n// Only the tools actually in the agent's allowedTools list; MultiEdit and\n// NotebookEdit are intentionally excluded from the agent's tool set.\nconst FILE_MUTATING_TOOLS = new Set([\"Write\", \"Edit\"]);\n\nfunction hasStringFilePath(input: unknown): input is { file_path: string } {\n  return typeof input === \"object\" && input !== null && \"file_path\" in input && typeof input.file_path === \"string\";\n}\n\nexport function getToolWriteTargetPath(toolName: string, toolInput: unknown, cwd: string): string | null {\n  if (!FILE_MUTATING_TOOLS.has(toolName) || !hasStringFilePath(toolInput)) {\n    return null;\n  }\n  return path.isAbsolute(toolInput.file_path) ? toolInput.file_path : path.resolve(cwd, toolInput.file_path);\n}\n\nexport function isPathInsideDir(dir: string, target: string): boolean {\n  const relative = path.relative(path.resolve(dir), path.resolve(target));\n  return relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative));\n}\n"],"mappings":";;;;;;;AAIA,MAAM,2BAAmC,QAAQ,IAAI,0BAD3B;AAkC1B,IAAa,0BAAb,cAA6C,MAAM;CACjD,YAAY,WAAoB;AAC9B,QAAM,yBAAyB,aAAa,OAAO,KAAK,UAAU,UAAU,IAAI,GAAG;AACnF,OAAK,OAAO;;;AAIhB,IAAa,0BAAb,cAA6C,MAAM;CACjD,YAAY,SAAiB;AAC3B,QAAM,wBAAwB,QAAQ,IAAI;AAC1C,OAAK,OAAO;;;AAIhB,SAAS,aAAa,OAAyB;AAC7C,QAAO,iBAAiB,SAAS,MAAM,SAAS;;AAGlD,SAAgB,qBAAyD;CACvE,MAAM,MAAM,EAAE,GAAG,QAAQ,KAAK;AAE9B,QAAO,IAAI;AACX,QAAO;;AAGT,eAAsB,uBAAuB,SAA+D;CAC1G,MAAM,kBAAkB,IAAI,iBAAiB;CAC7C,MAAM,UAAU,QAAQ,aAAa,OAAO,OAAO,iBAAiB,gBAAgB,OAAO,EAAE,QAAQ,UAAU;CAC/G,IAAI,YAAY;CAChB,IAAI,aAAa;CACjB,MAAM,eAAe,QAAQ;AAC7B,KAAI;AACF,aAAW,MAAM,qDAAiB;GAChC,QAAQ,QAAQ;GAChB,SAAS;IACP,OAAO;IACP,GAAI,QAAQ,oBAAoB,OAAO;KACrC,gBAAgB,EAAE;KAClB,iBAAiB;KAClB,GAAG,EAAE;IACN,GAAI,gBAAgB,OAAO,EAAE,GAAG,EAC9B,OAAO,EACL,YAAY,CAAC,EACX,OAAO,CAAC,OAAO,UAAU;AACvB,SAAI,MAAM,oBAAoB,aAC5B,QAAO,EAAE,UAAU,MAAM;AAE3B,YAAO,MAAM,aAAa,MAAM;MAChC,EACH,CAAC,EACH,EACF;IACD,cAAc,QAAQ;IACtB,gBAAgB;IAChB,KAAK,QAAQ;IACb;IACA,KAAK;KACH,GAAG,oBAAoB;KACvB,GAAI,QAAQ,oBAAoB,OAAO,EAAE,iCAAiC,KAAK,GAAG,EAAE;KACpF,oBAAoB;KACpB,mBAAmB;KACpB;IACD,QAAQ,QAAQ;IACjB;GACF,CAAC,EAAE;AACF,WAAQ,YAAY,QAAQ;AAC5B,OAAI,QAAQ,SAAS,SACnB,KAAI,YAAY,SAAS;AACvB,gBAAY;AACZ,iBAAa,QAAQ;SAErB,OAAM,IAAI,wBAAwB,QAAQ,QAAQ;;UAIjD,OAAO;AACd,MAAI,gBAAgB,OAAO,WAAW,aAAa,MAAM,CACvD,OAAM,IAAI,wBAAwB,QAAQ,aAAa,OAAU;AAEnE,QAAM;WACE;AACR,MAAI,WAAW,KACb,cAAa,QAAQ;;AAGzB,KAAI,CAAC,UACH,OAAM,IAAI,MAAM,iDAAiD;AAEnE,QAAO,EAAE,YAAY;;AAKvB,MAAM,sBAAsB,IAAI,IAAI,CAAC,SAAS,OAAO,CAAC;AAEtD,SAAS,kBAAkB,OAAgD;AACzE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,eAAe,SAAS,OAAO,MAAM,cAAc;;AAG3G,SAAgB,uBAAuB,UAAkB,WAAoB,KAA4B;AACvG,KAAI,CAAC,oBAAoB,IAAI,SAAS,IAAI,CAAC,kBAAkB,UAAU,CACrE,QAAO;AAET,QAAO,aAAK,WAAW,UAAU,UAAU,GAAG,UAAU,YAAY,aAAK,QAAQ,KAAK,UAAU,UAAU;;AAG5G,SAAgB,gBAAgB,KAAa,QAAyB;CACpE,MAAM,WAAW,aAAK,SAAS,aAAK,QAAQ,IAAI,EAAE,aAAK,QAAQ,OAAO,CAAC;AACvE,QAAO,aAAa,MAAO,CAAC,SAAS,WAAW,KAAK,IAAI,CAAC,aAAK,WAAW,SAAS"}

package/dist/esm/config-agent.d.ts

@@ -0,0 +1,42 @@
+//#region src/config-agent.d.ts
+type ClaudeAgentToolName = "Read" | "Write" | "Edit" | "MultiEdit" | "NotebookEdit" | "Bash" | "Glob" | "Grep";
+type ClaudeAgentHookResult = {
+  continue: true;
+} | {
+  hookSpecificOutput: {
+    hookEventName: "PreToolUse";
+    permissionDecision: "deny";
+    permissionDecisionReason: string;
+  };
+};
+type ClaudeAgentPreToolUseInput = {
+  hook_event_name: "PreToolUse";
+  tool_name: string;
+  tool_input: unknown;
+};
+type RunClaudeAgentOptions = {
+  prompt: string;
+  cwd: string;
+  allowedTools: ClaudeAgentToolName[];
+  timeoutMs?: number;
+  strictIsolation?: boolean;
+  stderr?: (data: string) => void;
+  onMessage?: (message: unknown) => void;
+  onPreToolUse?: (input: ClaudeAgentPreToolUseInput) => Promise<ClaudeAgentHookResult> | ClaudeAgentHookResult;
+};
+type RunClaudeAgentResult = {
+  resultText: string;
+};
+declare class ClaudeAgentTimeoutError extends Error {
+  constructor(timeoutMs?: number);
+}
+declare class ClaudeAgentFailureError extends Error {
+  constructor(subtype: string);
+}
+declare function stripClaudeCodeEnv(): Record<string, string | undefined>;
+declare function runHeadlessClaudeAgent(options: RunClaudeAgentOptions): Promise<RunClaudeAgentResult>;
+declare function getToolWriteTargetPath(toolName: string, toolInput: unknown, cwd: string): string | null;
+declare function isPathInsideDir(dir: string, target: string): boolean;
+//#endregion
+export { ClaudeAgentFailureError, ClaudeAgentPreToolUseInput, ClaudeAgentTimeoutError, ClaudeAgentToolName, RunClaudeAgentOptions, RunClaudeAgentResult, getToolWriteTargetPath, isPathInsideDir, runHeadlessClaudeAgent, stripClaudeCodeEnv };
+//# sourceMappingURL=config-agent.d.ts.map

package/dist/esm/config-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-agent.d.ts","names":[],"sources":["../../src/config-agent.ts"],"mappings":";KAMY,mBAAA;AAAA,KAEP,qBAAA;EAA0B,QAAA;AAAA;EAC7B,kBAAA;IACE,aAAA;IACA,kBAAA;IACA,wBAAA;EAAA;AAAA;AAAA,KAIQ,0BAAA;EACV,eAAA;EACA,SAAA;EACA,UAAA;AAAA;AAAA,KAGU,qBAAA;EACV,MAAA;EACA,GAAA;EACA,YAAA,EAAc,mBAAA;EACd,SAAA;EACA,eAAA;EACA,MAAA,IAAU,IAAA;EACV,SAAA,IAAa,OAAA;EACb,YAAA,IAAgB,KAAA,EAAO,0BAAA,KAA+B,OAAA,CAAQ,qBAAA,IAAyB,qBAAA;AAAA;AAAA,KAG7E,oBAAA;EACV,UAAA;AAAA;AAAA,cAGW,uBAAA,SAAgC,KAAA;cAC/B,SAAA;AAAA;AAAA,cAMD,uBAAA,SAAgC,KAAA;cAC/B,OAAA;AAAA;AAAA,iBAUE,kBAAA,CAAA,GAAsB,MAAA;AAAA,iBAOhB,sBAAA,CAAuB,OAAA,EAAS,qBAAA,GAAwB,OAAA,CAAQ,oBAAA;AAAA,iBA0EtE,sBAAA,CAAuB,QAAA,UAAkB,SAAA,WAAoB,GAAA;AAAA,iBAO7D,eAAA,CAAgB,GAAA,UAAa,MAAA"}

package/dist/esm/config-agent.js

@@ -0,0 +1,88 @@
+import { query } from "@anthropic-ai/claude-agent-sdk";
+import path from "path";
+
+//#region src/config-agent.ts
+const ANTHROPIC_PROXY_BASE_URL = process.env.STACK_CLAUDE_PROXY_URL ?? "https://api.hexclave.com/api/v1/integrations/ai-proxy";
+var ClaudeAgentTimeoutError = class extends Error {
+	constructor(timeoutMs) {
+		super(`Claude agent timed out${timeoutMs == null ? "" : ` after ${timeoutMs}ms`}.`);
+		this.name = "ClaudeAgentTimeoutError";
+	}
+};
+var ClaudeAgentFailureError = class extends Error {
+	constructor(subtype) {
+		super(`Claude agent failed (${subtype}).`);
+		this.name = "ClaudeAgentFailureError";
+	}
+};
+function isAbortError(error) {
+	return error instanceof Error && error.name === "AbortError";
+}
+function stripClaudeCodeEnv() {
+	const env = { ...process.env };
+	delete env.CLAUDECODE;
+	return env;
+}
+async function runHeadlessClaudeAgent(options) {
+	const abortController = new AbortController();
+	const timeout = options.timeoutMs == null ? null : setTimeout(() => abortController.abort(), options.timeoutMs);
+	let sawResult = false;
+	let resultText = "";
+	const onPreToolUse = options.onPreToolUse;
+	try {
+		for await (const message of query({
+			prompt: options.prompt,
+			options: {
+				model: "nvidia/nemotron-3-super-120b-a12b:nitro",
+				...options.strictIsolation === true ? {
+					settingSources: [],
+					strictMcpConfig: true
+				} : {},
+				...onPreToolUse == null ? {} : { hooks: { PreToolUse: [{ hooks: [async (input) => {
+					if (input.hook_event_name !== "PreToolUse") return { continue: true };
+					return await onPreToolUse(input);
+				}] }] } },
+				allowedTools: options.allowedTools,
+				permissionMode: "dontAsk",
+				cwd: options.cwd,
+				abortController,
+				env: {
+					...stripClaudeCodeEnv(),
+					...options.strictIsolation === true ? { CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1" } : {},
+					ANTHROPIC_BASE_URL: ANTHROPIC_PROXY_BASE_URL,
+					ANTHROPIC_API_KEY: "stack-auth-proxy"
+				},
+				stderr: options.stderr
+			}
+		})) {
+			options.onMessage?.(message);
+			if (message.type === "result") if ("result" in message) {
+				sawResult = true;
+				resultText = message.result;
+			} else throw new ClaudeAgentFailureError(message.subtype);
+		}
+	} catch (error) {
+		if (abortController.signal.aborted && isAbortError(error)) throw new ClaudeAgentTimeoutError(options.timeoutMs ?? void 0);
+		throw error;
+	} finally {
+		if (timeout != null) clearTimeout(timeout);
+	}
+	if (!sawResult) throw new Error("Claude agent ended without reporting a result.");
+	return { resultText };
+}
+const FILE_MUTATING_TOOLS = new Set(["Write", "Edit"]);
+function hasStringFilePath(input) {
+	return typeof input === "object" && input !== null && "file_path" in input && typeof input.file_path === "string";
+}
+function getToolWriteTargetPath(toolName, toolInput, cwd) {
+	if (!FILE_MUTATING_TOOLS.has(toolName) || !hasStringFilePath(toolInput)) return null;
+	return path.isAbsolute(toolInput.file_path) ? toolInput.file_path : path.resolve(cwd, toolInput.file_path);
+}
+function isPathInsideDir(dir, target) {
+	const relative = path.relative(path.resolve(dir), path.resolve(target));
+	return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+
+//#endregion
+export { ClaudeAgentFailureError, ClaudeAgentTimeoutError, getToolWriteTargetPath, isPathInsideDir, runHeadlessClaudeAgent, stripClaudeCodeEnv };
+//# sourceMappingURL=config-agent.js.map

package/dist/esm/config-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-agent.js","names":[],"sources":["../../src/config-agent.ts"],"sourcesContent":["import { query } from \"@anthropic-ai/claude-agent-sdk\";\nimport path from \"path\";\n\nconst DEFAULT_PROXY_URL = \"https://api.hexclave.com/api/v1/integrations/ai-proxy\";\nconst ANTHROPIC_PROXY_BASE_URL: string = process.env.STACK_CLAUDE_PROXY_URL ?? DEFAULT_PROXY_URL;\n\nexport type ClaudeAgentToolName = \"Read\" | \"Write\" | \"Edit\" | \"MultiEdit\" | \"NotebookEdit\" | \"Bash\" | \"Glob\" | \"Grep\";\n\ntype ClaudeAgentHookResult = { continue: true } | {\n  hookSpecificOutput: {\n    hookEventName: \"PreToolUse\",\n    permissionDecision: \"deny\",\n    permissionDecisionReason: string,\n  },\n};\n\nexport type ClaudeAgentPreToolUseInput = {\n  hook_event_name: \"PreToolUse\",\n  tool_name: string,\n  tool_input: unknown,\n};\n\nexport type RunClaudeAgentOptions = {\n  prompt: string,\n  cwd: string,\n  allowedTools: ClaudeAgentToolName[],\n  timeoutMs?: number,\n  strictIsolation?: boolean,\n  stderr?: (data: string) => void,\n  onMessage?: (message: unknown) => void,\n  onPreToolUse?: (input: ClaudeAgentPreToolUseInput) => Promise<ClaudeAgentHookResult> | ClaudeAgentHookResult,\n};\n\nexport type RunClaudeAgentResult = {\n  resultText: string,\n};\n\nexport class ClaudeAgentTimeoutError extends Error {\n  constructor(timeoutMs?: number) {\n    super(`Claude agent timed out${timeoutMs == null ? \"\" : ` after ${timeoutMs}ms`}.`);\n    this.name = \"ClaudeAgentTimeoutError\";\n  }\n}\n\nexport class ClaudeAgentFailureError extends Error {\n  constructor(subtype: string) {\n    super(`Claude agent failed (${subtype}).`);\n    this.name = \"ClaudeAgentFailureError\";\n  }\n}\n\nfunction isAbortError(error: unknown): boolean {\n  return error instanceof Error && error.name === \"AbortError\";\n}\n\nexport function stripClaudeCodeEnv(): Record<string, string | undefined> {\n  const env = { ...process.env };\n  // CLAUDECODE must be unset for nested agents; ANTHROPIC_API_KEY must be non-empty (proxy ignores it).\n  delete env.CLAUDECODE;\n  return env;\n}\n\nexport async function runHeadlessClaudeAgent(options: RunClaudeAgentOptions): Promise<RunClaudeAgentResult> {\n  const abortController = new AbortController();\n  const timeout = options.timeoutMs == null ? null : setTimeout(() => abortController.abort(), options.timeoutMs);\n  let sawResult = false;\n  let resultText = \"\";\n  const onPreToolUse = options.onPreToolUse;\n  try {\n    for await (const message of query({\n      prompt: options.prompt,\n      options: {\n        model: \"nvidia/nemotron-3-super-120b-a12b:nitro\",\n        ...(options.strictIsolation === true ? {\n          settingSources: [],\n          strictMcpConfig: true,\n        } : {}),\n        ...(onPreToolUse == null ? {} : {\n          hooks: {\n            PreToolUse: [{\n              hooks: [async (input) => {\n                if (input.hook_event_name !== \"PreToolUse\") {\n                  return { continue: true };\n                }\n                return await onPreToolUse(input);\n              }],\n            }],\n          },\n        }),\n        allowedTools: options.allowedTools,\n        permissionMode: \"dontAsk\",\n        cwd: options.cwd,\n        abortController,\n        env: {\n          ...stripClaudeCodeEnv(),\n          ...(options.strictIsolation === true ? { CLAUDE_CODE_DISABLE_AUTO_MEMORY: \"1\" } : {}),\n          ANTHROPIC_BASE_URL: ANTHROPIC_PROXY_BASE_URL,\n          ANTHROPIC_API_KEY: \"stack-auth-proxy\",\n        },\n        stderr: options.stderr,\n      },\n    })) {\n      options.onMessage?.(message);\n      if (message.type === \"result\") {\n        if (\"result\" in message) {\n          sawResult = true;\n          resultText = message.result;\n        } else {\n          throw new ClaudeAgentFailureError(message.subtype);\n        }\n      }\n    }\n  } catch (error) {\n    if (abortController.signal.aborted && isAbortError(error)) {\n      throw new ClaudeAgentTimeoutError(options.timeoutMs ?? undefined);\n    }\n    throw error;\n  } finally {\n    if (timeout != null) {\n      clearTimeout(timeout);\n    }\n  }\n  if (!sawResult) {\n    throw new Error(\"Claude agent ended without reporting a result.\");\n  }\n  return { resultText };\n}\n\n// Only the tools actually in the agent's allowedTools list; MultiEdit and\n// NotebookEdit are intentionally excluded from the agent's tool set.\nconst FILE_MUTATING_TOOLS = new Set([\"Write\", \"Edit\"]);\n\nfunction hasStringFilePath(input: unknown): input is { file_path: string } {\n  return typeof input === \"object\" && input !== null && \"file_path\" in input && typeof input.file_path === \"string\";\n}\n\nexport function getToolWriteTargetPath(toolName: string, toolInput: unknown, cwd: string): string | null {\n  if (!FILE_MUTATING_TOOLS.has(toolName) || !hasStringFilePath(toolInput)) {\n    return null;\n  }\n  return path.isAbsolute(toolInput.file_path) ? toolInput.file_path : path.resolve(cwd, toolInput.file_path);\n}\n\nexport function isPathInsideDir(dir: string, target: string): boolean {\n  const relative = path.relative(path.resolve(dir), path.resolve(target));\n  return relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative));\n}\n"],"mappings":";;;;AAIA,MAAM,2BAAmC,QAAQ,IAAI,0BAD3B;AAkC1B,IAAa,0BAAb,cAA6C,MAAM;CACjD,YAAY,WAAoB;AAC9B,QAAM,yBAAyB,aAAa,OAAO,KAAK,UAAU,UAAU,IAAI,GAAG;AACnF,OAAK,OAAO;;;AAIhB,IAAa,0BAAb,cAA6C,MAAM;CACjD,YAAY,SAAiB;AAC3B,QAAM,wBAAwB,QAAQ,IAAI;AAC1C,OAAK,OAAO;;;AAIhB,SAAS,aAAa,OAAyB;AAC7C,QAAO,iBAAiB,SAAS,MAAM,SAAS;;AAGlD,SAAgB,qBAAyD;CACvE,MAAM,MAAM,EAAE,GAAG,QAAQ,KAAK;AAE9B,QAAO,IAAI;AACX,QAAO;;AAGT,eAAsB,uBAAuB,SAA+D;CAC1G,MAAM,kBAAkB,IAAI,iBAAiB;CAC7C,MAAM,UAAU,QAAQ,aAAa,OAAO,OAAO,iBAAiB,gBAAgB,OAAO,EAAE,QAAQ,UAAU;CAC/G,IAAI,YAAY;CAChB,IAAI,aAAa;CACjB,MAAM,eAAe,QAAQ;AAC7B,KAAI;AACF,aAAW,MAAM,WAAW,MAAM;GAChC,QAAQ,QAAQ;GAChB,SAAS;IACP,OAAO;IACP,GAAI,QAAQ,oBAAoB,OAAO;KACrC,gBAAgB,EAAE;KAClB,iBAAiB;KAClB,GAAG,EAAE;IACN,GAAI,gBAAgB,OAAO,EAAE,GAAG,EAC9B,OAAO,EACL,YAAY,CAAC,EACX,OAAO,CAAC,OAAO,UAAU;AACvB,SAAI,MAAM,oBAAoB,aAC5B,QAAO,EAAE,UAAU,MAAM;AAE3B,YAAO,MAAM,aAAa,MAAM;MAChC,EACH,CAAC,EACH,EACF;IACD,cAAc,QAAQ;IACtB,gBAAgB;IAChB,KAAK,QAAQ;IACb;IACA,KAAK;KACH,GAAG,oBAAoB;KACvB,GAAI,QAAQ,oBAAoB,OAAO,EAAE,iCAAiC,KAAK,GAAG,EAAE;KACpF,oBAAoB;KACpB,mBAAmB;KACpB;IACD,QAAQ,QAAQ;IACjB;GACF,CAAC,EAAE;AACF,WAAQ,YAAY,QAAQ;AAC5B,OAAI,QAAQ,SAAS,SACnB,KAAI,YAAY,SAAS;AACvB,gBAAY;AACZ,iBAAa,QAAQ;SAErB,OAAM,IAAI,wBAAwB,QAAQ,QAAQ;;UAIjD,OAAO;AACd,MAAI,gBAAgB,OAAO,WAAW,aAAa,MAAM,CACvD,OAAM,IAAI,wBAAwB,QAAQ,aAAa,OAAU;AAEnE,QAAM;WACE;AACR,MAAI,WAAW,KACb,cAAa,QAAQ;;AAGzB,KAAI,CAAC,UACH,OAAM,IAAI,MAAM,iDAAiD;AAEnE,QAAO,EAAE,YAAY;;AAKvB,MAAM,sBAAsB,IAAI,IAAI,CAAC,SAAS,OAAO,CAAC;AAEtD,SAAS,kBAAkB,OAAgD;AACzE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,eAAe,SAAS,OAAO,MAAM,cAAc;;AAG3G,SAAgB,uBAAuB,UAAkB,WAAoB,KAA4B;AACvG,KAAI,CAAC,oBAAoB,IAAI,SAAS,IAAI,CAAC,kBAAkB,UAAU,CACrE,QAAO;AAET,QAAO,KAAK,WAAW,UAAU,UAAU,GAAG,UAAU,YAAY,KAAK,QAAQ,KAAK,UAAU,UAAU;;AAG5G,SAAgB,gBAAgB,KAAa,QAAyB;CACpE,MAAM,WAAW,KAAK,SAAS,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,OAAO,CAAC;AACvE,QAAO,aAAa,MAAO,CAAC,SAAS,WAAW,KAAK,IAAI,CAAC,KAAK,WAAW,SAAS"}

package/dist/esm/index.d.ts

@@ -0,0 +1,16 @@
+import { Config } from "@hexclave/shared/dist/config/format";
+
+//#region src/index.d.ts
+declare function sha256String(value: string): string;
+declare function resolveConfigFilePath(inputPath: string): string;
+declare function ensureConfigFileExists(configFilePath: string): void;
+declare function readConfigObject(configFilePath: string): Promise<Config>;
+declare function readConfigFile(configFilePath: string): Promise<{
+  config: Config;
+  showOnboarding: boolean;
+}>;
+declare function updateConfigObject(configFilePath: string, configUpdate: Config): Promise<void>;
+declare function replaceConfigObject(configFilePath: string, config: Config): Promise<void>;
+//#endregion
+export { ensureConfigFileExists, readConfigFile, readConfigObject, replaceConfigObject, resolveConfigFilePath, sha256String, updateConfigObject };
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/index.ts"],"mappings":";;;iBA2BgB,YAAA,CAAa,KAAA;AAAA,iBAIb,qBAAA,CAAsB,SAAA;AAAA,iBAkBtB,sBAAA,CAAuB,cAAA;AAAA,iBAMjB,gBAAA,CAAiB,cAAA,WAAyB,OAAA,CAAQ,MAAA;AAAA,iBAIlD,cAAA,CAAe,cAAA,WAAyB,OAAA;EAAU,MAAA,EAAQ,MAAA;EAAQ,cAAA;AAAA;AAAA,iBAkElE,kBAAA,CAAmB,cAAA,UAAwB,YAAA,EAAc,MAAA,GAAS,OAAA;AAAA,iBA2ClE,mBAAA,CAAoB,cAAA,UAAwB,MAAA,EAAQ,MAAA,GAAS,OAAA"}

package/dist/esm/index.js

@@ -0,0 +1,327 @@
+import path from "path";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
+import { showOnboardingHexclaveConfigValue } from "@hexclave/shared/dist/config-authoring";
+import { detectImportPackageFromDir, parseHexclaveConfigFileContent, renderConfigFileContent } from "@hexclave/shared/dist/config-rendering";
+import { isValidConfig, normalize, override } from "@hexclave/shared/dist/config/format";
+import { captureError } from "@hexclave/shared/dist/utils/errors";
+import { createHash } from "crypto";
+import { createJiti } from "jiti";
+import { ClaudeAgentFailureError, ClaudeAgentTimeoutError, getToolWriteTargetPath, isPathInsideDir, runHeadlessClaudeAgent } from "./config-agent.js";
+
+//#region src/index.ts
+const jiti = createJiti(import.meta.url, { moduleCache: false });
+const LOG_PREFIX = "[Stack config updater]";
+const DEFAULT_AGENT_TIMEOUT_MS = 12e4;
+function isConfigModule(value) {
+	return value !== null && typeof value === "object";
+}
+function sha256String(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
+function resolveConfigFilePath(inputPath) {
+	const resolved = path.resolve(inputPath);
+	if (/\.(ts|js|mjs|cjs)$/i.test(resolved)) return resolved;
+	const hexclaveCandidate = path.join(resolved, "hexclave.config.ts");
+	const legacyCandidate = path.join(resolved, "stack.config.ts");
+	if (existsSync(hexclaveCandidate)) return hexclaveCandidate;
+	if (existsSync(legacyCandidate)) return legacyCandidate;
+	return hexclaveCandidate;
+}
+function ensureConfigFileExists(configFilePath) {
+	if (existsSync(configFilePath)) return;
+	mkdirSync(path.dirname(configFilePath), { recursive: true });
+	renderConfigObjectToFile(configFilePath, {});
+}
+async function readConfigObject(configFilePath) {
+	return (await readConfigFile(configFilePath)).config;
+}
+async function readConfigFile(configFilePath) {
+	ensureConfigFileExists(configFilePath);
+	if (readFileSync(configFilePath, "utf-8").trim() === "") return {
+		config: {},
+		showOnboarding: false
+	};
+	let configModule;
+	try {
+		configModule = await jiti.import(configFilePath);
+	} catch (error) {
+		captureError("shared-backend/readConfigFile", error);
+		throw new Error(`Failed to load config file ${configFilePath}. If your config imports a value (e.g. defineHexclaveConfig) from a framework package such as "@hexclave/next", import it from that package's lightweight "/config" entrypoint instead, which doesn't load the framework runtime:\n\n  import { defineHexclaveConfig } from "@hexclave/next/config";\n`);
+	}
+	if (!isConfigModule(configModule)) throw new Error(`Invalid config in ${configFilePath}. The file must export a plain \`config\` object or "show-onboarding".`);
+	const config = configModule.config;
+	if (config === showOnboardingHexclaveConfigValue) return {
+		config: {},
+		showOnboarding: true
+	};
+	if (!isValidConfig(config)) throw new Error(`Invalid config in ${configFilePath}.`);
+	return {
+		config,
+		showOnboarding: false
+	};
+}
+function renderConfigObjectToString(configFilePath, config) {
+	return renderConfigFileContent(config, detectImportPackageFromDir(path.dirname(configFilePath)));
+}
+function writeFileAtomic(configFilePath, content) {
+	const dir = path.dirname(configFilePath);
+	mkdirSync(dir, { recursive: true });
+	const tempPath = path.join(dir, `.stack.config.${Math.random().toString(36).slice(2)}.tmp`);
+	writeFileSync(tempPath, content, "utf-8");
+	try {
+		renameSync(tempPath, configFilePath);
+	} catch (error) {
+		try {
+			rmSync(tempPath);
+		} catch {}
+		throw error;
+	}
+}
+function renderConfigObjectToFile(configFilePath, config) {
+	writeFileAtomic(configFilePath, renderConfigObjectToString(configFilePath, config));
+}
+async function updateConfigObject(configFilePath, configUpdate) {
+	ensureConfigFileExists(configFilePath);
+	if (flattenConfigUpdate(configUpdate).length === 0) return;
+	const content = readFileSync(configFilePath, "utf-8");
+	const staticConfig = tryParseStaticConfigFileContent(content, configFilePath);
+	if (staticConfig != null && isValidConfig(staticConfig)) {
+		const merged = override(staticConfig, configUpdate);
+		if (!isValidConfig(merged)) throw new Error(`${LOG_PREFIX} Merged config is invalid after applying update to ${configFilePath}`);
+		renderConfigObjectToFile(configFilePath, merged);
+		return;
+	}
+	const baselineConfig = await tryReadConfigForValidation(configFilePath);
+	const { snapshots, seen } = snapshotConfigFiles(configFilePath, content);
+	try {
+		await runConfigUpdateAgent({
+			prompt: buildConfigUpdatePrompt(path.basename(configFilePath), configUpdate, baselineConfig),
+			cwd: path.dirname(configFilePath),
+			onFileWillChange: (filePath) => captureSnapshotIfAbsent(snapshots, filePath, seen)
+		});
+		await validateAgentUpdate(configFilePath, baselineConfig, configUpdate, snapshots);
+	} catch (error) {
+		try {
+			restoreConfigFiles(snapshots);
+		} catch (restoreError) {
+			console.error(`${LOG_PREFIX} Failed to fully roll back config files after a failed update of ${configFilePath}; some files may be left in a partially-restored state`, {
+				configFilePath,
+				restoreError: restoreError instanceof Error ? restoreError.message : String(restoreError)
+			});
+		}
+		throw error;
+	}
+}
+async function replaceConfigObject(configFilePath, config) {
+	renderConfigObjectToFile(configFilePath, config);
+}
+async function runConfigUpdateAgent(options) {
+	const timeoutMs = parseAgentTimeoutMs();
+	const deniedOutOfBoundsWrites = /* @__PURE__ */ new Set();
+	try {
+		await runHeadlessClaudeAgent({
+			prompt: options.prompt,
+			cwd: options.cwd,
+			allowedTools: [
+				"Read",
+				"Write",
+				"Edit",
+				"Glob",
+				"Grep"
+			],
+			strictIsolation: true,
+			timeoutMs,
+			stderr: (data) => {
+				console.warn(`${LOG_PREFIX} [agent] ${data}`);
+			},
+			onPreToolUse: (input) => {
+				const target = getToolWriteTargetPath(input.tool_name, input.tool_input, options.cwd);
+				if (target == null) return { continue: true };
+				if (!isPathInsideDir(options.cwd, target)) {
+					deniedOutOfBoundsWrites.add(target);
+					return { hookSpecificOutput: {
+						hookEventName: "PreToolUse",
+						permissionDecision: "deny",
+						permissionDecisionReason: `Refusing to modify ${target}: config updates may only change files inside the config directory.`
+					} };
+				}
+				options.onFileWillChange?.(target);
+				return { continue: true };
+			}
+		});
+	} catch (error) {
+		if (error instanceof ClaudeAgentTimeoutError) throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);
+		if (error instanceof ClaudeAgentFailureError) throw new Error(`${error.message} It was unable to apply the config changes to the file.`);
+		throw error;
+	}
+	if (deniedOutOfBoundsWrites.size > 0) throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(", ")}. The config was not updated.`);
+}
+function parseAgentTimeoutMs() {
+	const raw = process.env.STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS;
+	if (raw == null || raw.trim() === "") return DEFAULT_AGENT_TIMEOUT_MS;
+	const parsed = Number(raw);
+	if (!Number.isFinite(parsed) || parsed <= 0) throw new Error(`Invalid STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS: ${JSON.stringify(raw)}. Expected a positive number of milliseconds.`);
+	return parsed;
+}
+function captureSnapshotIfAbsent(snapshots, filePath, seen) {
+	const resolved = path.resolve(filePath);
+	if (seen.has(resolved)) return;
+	seen.add(resolved);
+	snapshots.push({
+		path: resolved,
+		content: existsSync(resolved) ? readFileSync(resolved, "utf-8") : null
+	});
+}
+function snapshotConfigFiles(configFilePath, configContent) {
+	const dir = path.dirname(configFilePath);
+	const resolvedConfig = path.resolve(configFilePath);
+	const snapshots = [{
+		path: resolvedConfig,
+		content: configContent
+	}];
+	const seen = new Set([resolvedConfig]);
+	for (const specifier of getRelativeImportSpecifiers(configContent)) {
+		const resolved = path.resolve(dir, specifier);
+		if (!isPathInsideDir(dir, resolved)) continue;
+		captureSnapshotIfAbsent(snapshots, resolved, seen);
+	}
+	return {
+		snapshots,
+		seen
+	};
+}
+function restoreConfigFiles(snapshots) {
+	const failures = [];
+	for (const { path: filePath, content } of snapshots) try {
+		if (content === null) {
+			if (existsSync(filePath)) rmSync(filePath);
+		} else writeFileSync(filePath, content, "utf-8");
+	} catch (error) {
+		failures.push(`${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (failures.length > 0) throw new Error(`Failed to restore ${failures.length} file(s) during rollback: ${failures.join("; ")}`);
+}
+async function tryReadConfigForValidation(configFilePath) {
+	try {
+		return (await readConfigFile(configFilePath)).config;
+	} catch (error) {
+		console.warn(`${LOG_PREFIX} Could not evaluate config for validation baseline; will fall back to a structural check`, {
+			configFilePath,
+			error: error instanceof Error ? error.message : String(error)
+		});
+		return null;
+	}
+}
+async function validateAgentUpdate(configFilePath, baselineConfig, configUpdate, snapshots) {
+	if (baselineConfig != null) {
+		const target = canonicalizeConfig(override(baselineConfig, configUpdate));
+		if (!configsEqual(canonicalizeConfig((await readConfigFile(configFilePath)).config), target)) throw new Error(`Config update validation failed for ${configFilePath}: the updated file does not evaluate to the expected configuration.`);
+		return;
+	}
+	if (flattenConfigUpdate(configUpdate).length > 0 && !snapshotsChangedOnDisk(snapshots)) console.warn(`${LOG_PREFIX} Agent did not modify any file for ${configFilePath}; assuming values are already up to date.`);
+	if (!configFileExportsConfig(readFileSync(configFilePath, "utf-8"), configFilePath)) throw new Error(`Config update validation failed for ${configFilePath}: the updated file no longer exports a valid \`config\`.`);
+}
+function tryParseStaticConfigFileContent(content, configFilePath) {
+	try {
+		const parsed = parseHexclaveConfigFileContent(content, configFilePath);
+		return isValidConfig(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function configFileExportsConfig(content, configFilePath) {
+	try {
+		parseHexclaveConfigFileContent(content, configFilePath);
+		return true;
+	} catch {
+		return /\bexport\s+const\s+config\b/.test(content);
+	}
+}
+function getRelativeImportSpecifiers(content) {
+	const specifiers = [];
+	const importPattern = /\bimport\b(?:[^'"]*?\bfrom\s*)?["'](\.{1,2}\/[^"']+)["']/g;
+	let match;
+	while ((match = importPattern.exec(content)) !== null) specifiers.push(match[1]);
+	return specifiers;
+}
+function snapshotsChangedOnDisk(snapshots) {
+	return snapshots.some(({ path: filePath, content }) => {
+		return (existsSync(filePath) ? readFileSync(filePath, "utf-8") : null) !== content;
+	});
+}
+function flattenConfigUpdate(update) {
+	const changes = [];
+	const walk = (prefix, obj) => {
+		for (const [key, value] of Object.entries(obj)) {
+			const fullPath = prefix === "" ? key : `${prefix}.${key}`;
+			if (value === void 0) continue;
+			if (value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length > 0) walk(fullPath, value);
+			else changes.push({
+				path: fullPath,
+				value
+			});
+		}
+	};
+	walk("", update);
+	return changes;
+}
+function buildConfigUpdatePrompt(configFileName, configUpdate, baselineConfig) {
+	const changeLines = flattenConfigUpdate(configUpdate).map(({ path: configPath, value }) => {
+		return `- ${JSON.stringify(configPath)}: set to ${JSON.stringify(value)}`;
+	}).join("\n");
+	const expectedConfig = baselineConfig == null ? null : canonicalizeConfig(override(baselineConfig, configUpdate));
+	const expectedConfigSection = expectedConfig == null ? "" : `
+After the edit, evaluating the exported \`config\` must produce this exact JSON value:
+
+${JSON.stringify(expectedConfig, null, 2)}
+`;
+	return `You are editing a Hexclave / Stack Auth configuration file in place. Apply a set of configuration changes WITHOUT changing how the file is written.
+
+Config file: ${JSON.stringify(configFileName)} (in the current working directory).
+
+The file exports a \`config\` object (it may be wrapped in a helper such as \`defineStackConfig(...)\`). Some config values may be sourced from other files via imports, for example:
+
+    import welcomeEmail from "./welcome-email.tsx" with { type: "text" };
+    export const config = { emails: { templates: { welcome: welcomeEmail } } };
+
+Apply EXACTLY these changes. Paths use dot notation, so \`a.b.c\` refers to \`config.a.b.c\`:
+
+${changeLines}
+${expectedConfigSection}
+
+Rules:
+- Change ONLY the config paths listed above. Leave every other part of the file byte-for-byte unchanged: imports, comments, formatting, helper wrappers, and any config fields not listed.
+- If a listed path's value is currently provided by an imported external file (like the \`import ... with { type: "text" }\` example above), DO NOT inline the new value into the config file. Instead, overwrite that external file with the new value and keep the import statement intact.
+- If a listed path's value is a plain inline literal, edit it inline.
+- Keep the file valid: it must still export a \`config\` that, once evaluated, reflects the new values exactly.
+- Do not run any shell commands and do not create files other than what is required to apply these changes.`;
+}
+function canonicalizeConfig(config) {
+	const droppedKeys = [];
+	const normalized = normalize(config, {
+		onDotIntoNonObject: "ignore",
+		onDotIntoNull: "empty-object",
+		droppedKeys
+	});
+	if (droppedKeys.length > 0) throw new Error(`Config update has conflicting keys that would be dropped during normalization: ${droppedKeys.map((key) => JSON.stringify(key)).join(", ")}`);
+	return normalized;
+}
+function configsEqual(a, b) {
+	if (a === b) return true;
+	if (a === null || b === null) return a === b;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((value, index) => configsEqual(value, b[index]));
+	}
+	if (typeof a === "object" && typeof b === "object") {
+		const aEntries = Object.entries(a);
+		const bMap = new Map(Object.entries(b));
+		if (aEntries.length !== bMap.size) return false;
+		return aEntries.every(([key, value]) => bMap.has(key) && configsEqual(value, bMap.get(key)));
+	}
+	return false;
+}
+
+//#endregion
+export { ensureConfigFileExists, readConfigFile, readConfigObject, replaceConfigObject, resolveConfigFilePath, sha256String, updateConfigObject };
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/index.ts"],"sourcesContent":["import { showOnboardingHexclaveConfigValue } from \"@hexclave/shared/dist/config-authoring\";\nimport { detectImportPackageFromDir, parseHexclaveConfigFileContent, renderConfigFileContent } from \"@hexclave/shared/dist/config-rendering\";\nimport type { Config, ConfigValue, NormalizedConfig } from \"@hexclave/shared/dist/config/format\";\nimport { isValidConfig, normalize, override } from \"@hexclave/shared/dist/config/format\";\nimport { captureError } from \"@hexclave/shared/dist/utils/errors\";\nimport { createHash } from \"crypto\";\nimport { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from \"fs\";\nimport { createJiti } from \"jiti\";\nimport path from \"path\";\nimport { ClaudeAgentFailureError, ClaudeAgentTimeoutError, getToolWriteTargetPath, isPathInsideDir, runHeadlessClaudeAgent } from \"./config-agent\";\n\nconst jiti = createJiti(import.meta.url, { moduleCache: false });\n\nconst LOG_PREFIX = \"[Stack config updater]\";\nconst DEFAULT_AGENT_TIMEOUT_MS = 120_000;\n\ntype ConfigModule = {\n  config?: unknown,\n};\n\ntype ConfigFileSnapshot = { path: string, content: string | null };\ntype ConfigChange = { path: string, value: ConfigValue };\n\nfunction isConfigModule(value: unknown): value is ConfigModule {\n  return value !== null && typeof value === \"object\";\n}\n\nexport function sha256String(value: string): string {\n  return createHash(\"sha256\").update(value).digest(\"hex\");\n}\n\nexport function resolveConfigFilePath(inputPath: string): string {\n  const resolved = path.resolve(inputPath);\n  const looksLikeConfigFile = /\\.(ts|js|mjs|cjs)$/i.test(resolved);\n  if (looksLikeConfigFile) {\n    return resolved;\n  }\n  // Prefer hexclave.config.ts, fall back to stack.config.ts, default to the new name.\n  const hexclaveCandidate = path.join(resolved, \"hexclave.config.ts\");\n  const legacyCandidate = path.join(resolved, \"stack.config.ts\");\n  if (existsSync(hexclaveCandidate)) {\n    return hexclaveCandidate;\n  }\n  if (existsSync(legacyCandidate)) {\n    return legacyCandidate;\n  }\n  return hexclaveCandidate;\n}\n\nexport function ensureConfigFileExists(configFilePath: string): void {\n  if (existsSync(configFilePath)) return;\n  mkdirSync(path.dirname(configFilePath), { recursive: true });\n  renderConfigObjectToFile(configFilePath, {});\n}\n\nexport async function readConfigObject(configFilePath: string): Promise<Config> {\n  return (await readConfigFile(configFilePath)).config;\n}\n\nexport async function readConfigFile(configFilePath: string): Promise<{ config: Config, showOnboarding: boolean }> {\n  ensureConfigFileExists(configFilePath);\n  const content = readFileSync(configFilePath, \"utf-8\");\n  if (content.trim() === \"\") {\n    return {\n      config: {},\n      showOnboarding: false,\n    };\n  }\n\n  let configModule: unknown;\n  try {\n    configModule = await jiti.import<unknown>(configFilePath);\n  } catch (error) {\n    // Capture the raw jiti/framework error for diagnostics, but don't attach it as `cause` on the thrown error:\n    // dashboard error formatting renders causes recursively, which would leak framework internals into the\n    // user-facing message we're deliberately replacing.\n    captureError(\"shared-backend/readConfigFile\", error);\n    throw new Error(\n      `Failed to load config file ${configFilePath}. If your config imports a value (e.g. defineHexclaveConfig) from a framework package such as \"@hexclave/next\", import it from that package's lightweight \"/config\" entrypoint instead, which doesn't load the framework runtime:\\n\\n  import { defineHexclaveConfig } from \"@hexclave/next/config\";\\n`,\n    );\n  }\n  if (!isConfigModule(configModule)) {\n    throw new Error(`Invalid config in ${configFilePath}. The file must export a plain \\`config\\` object or \"show-onboarding\".`);\n  }\n\n  const config = configModule.config;\n  if (config === showOnboardingHexclaveConfigValue) {\n    return {\n      config: {},\n      showOnboarding: true,\n    };\n  }\n  if (!isValidConfig(config)) {\n    throw new Error(`Invalid config in ${configFilePath}.`);\n  }\n  return {\n    config,\n    showOnboarding: false,\n  };\n}\n\nfunction renderConfigObjectToString(configFilePath: string, config: Config): string {\n  const importPackage = detectImportPackageFromDir(path.dirname(configFilePath));\n  return renderConfigFileContent(config, importPackage);\n}\n\nfunction writeFileAtomic(configFilePath: string, content: string): void {\n  const dir = path.dirname(configFilePath);\n  mkdirSync(dir, { recursive: true });\n  const tempPath = path.join(dir, `.stack.config.${Math.random().toString(36).slice(2)}.tmp`);\n  writeFileSync(tempPath, content, \"utf-8\");\n  try {\n    renameSync(tempPath, configFilePath);\n  } catch (error) {\n    try {\n      rmSync(tempPath);\n    } catch { /* best-effort cleanup */ }\n    throw error;\n  }\n}\n\nfunction renderConfigObjectToFile(configFilePath: string, config: Config): void {\n  writeFileAtomic(configFilePath, renderConfigObjectToString(configFilePath, config));\n}\n\nexport async function updateConfigObject(configFilePath: string, configUpdate: Config): Promise<void> {\n  ensureConfigFileExists(configFilePath);\n\n  if (flattenConfigUpdate(configUpdate).length === 0) return;\n\n  const content = readFileSync(configFilePath, \"utf-8\");\n\n  // Fast path: if the config is a plain static literal (no imports, no helpers),\n  // apply the update deterministically without invoking the AI agent.\n  const staticConfig = tryParseStaticConfigFileContent(content, configFilePath);\n  if (staticConfig != null && isValidConfig(staticConfig)) {\n    const merged = override(staticConfig, configUpdate);\n    if (!isValidConfig(merged)) {\n      throw new Error(`${LOG_PREFIX} Merged config is invalid after applying update to ${configFilePath}`);\n    }\n    renderConfigObjectToFile(configFilePath, merged);\n    return;\n  }\n\n  // Agent path: config has custom structure (imports, helpers, external files)\n  // that must be preserved — delegate to the AI agent.\n  const baselineConfig = await tryReadConfigForValidation(configFilePath);\n  const { snapshots, seen } = snapshotConfigFiles(configFilePath, content);\n  try {\n    await runConfigUpdateAgent({\n      prompt: buildConfigUpdatePrompt(path.basename(configFilePath), configUpdate, baselineConfig),\n      cwd: path.dirname(configFilePath),\n      onFileWillChange: (filePath) => captureSnapshotIfAbsent(snapshots, filePath, seen),\n    });\n    await validateAgentUpdate(configFilePath, baselineConfig, configUpdate, snapshots);\n  } catch (error) {\n    try {\n      restoreConfigFiles(snapshots);\n    } catch (restoreError) {\n      console.error(`${LOG_PREFIX} Failed to fully roll back config files after a failed update of ${configFilePath}; some files may be left in a partially-restored state`, {\n        configFilePath,\n        restoreError: restoreError instanceof Error ? restoreError.message : String(restoreError),\n      });\n    }\n    throw error;\n  }\n}\n\nexport async function replaceConfigObject(configFilePath: string, config: Config): Promise<void> {\n  renderConfigObjectToFile(configFilePath, config);\n}\n\nasync function runConfigUpdateAgent(options: {\n  prompt: string,\n  cwd: string,\n  onFileWillChange?: (filePath: string) => void,\n}): Promise<void> {\n  const timeoutMs = parseAgentTimeoutMs();\n  const deniedOutOfBoundsWrites = new Set<string>();\n  try {\n    await runHeadlessClaudeAgent({\n      prompt: options.prompt,\n      cwd: options.cwd,\n      allowedTools: [\"Read\", \"Write\", \"Edit\", \"Glob\", \"Grep\"],\n      strictIsolation: true,\n      timeoutMs,\n      stderr: (data) => { console.warn(`${LOG_PREFIX} [agent] ${data}`); },\n      onPreToolUse: (input) => {\n        const target = getToolWriteTargetPath(input.tool_name, input.tool_input, options.cwd);\n        if (target == null) return { continue: true };\n        if (!isPathInsideDir(options.cwd, target)) {\n          deniedOutOfBoundsWrites.add(target);\n          return {\n            hookSpecificOutput: {\n              hookEventName: \"PreToolUse\",\n              permissionDecision: \"deny\",\n              permissionDecisionReason: `Refusing to modify ${target}: config updates may only change files inside the config directory.`,\n            },\n          };\n        }\n        options.onFileWillChange?.(target);\n        return { continue: true };\n      },\n    });\n  } catch (error) {\n    if (error instanceof ClaudeAgentTimeoutError) {\n      throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);\n    }\n    if (error instanceof ClaudeAgentFailureError) {\n      throw new Error(`${error.message} It was unable to apply the config changes to the file.`);\n    }\n    throw error;\n  }\n  if (deniedOutOfBoundsWrites.size > 0) {\n    throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(\", \")}. The config was not updated.`);\n  }\n}\n\nfunction parseAgentTimeoutMs(): number {\n  const raw = process.env.STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS;\n  if (raw == null || raw.trim() === \"\") return DEFAULT_AGENT_TIMEOUT_MS;\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed) || parsed <= 0) {\n    throw new Error(`Invalid STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS: ${JSON.stringify(raw)}. Expected a positive number of milliseconds.`);\n  }\n  return parsed;\n}\n\nfunction captureSnapshotIfAbsent(snapshots: ConfigFileSnapshot[], filePath: string, seen: Set<string>): void {\n  const resolved = path.resolve(filePath);\n  if (seen.has(resolved)) return;\n  seen.add(resolved);\n  snapshots.push({ path: resolved, content: existsSync(resolved) ? readFileSync(resolved, \"utf-8\") : null });\n}\n\nfunction snapshotConfigFiles(configFilePath: string, configContent: string): { snapshots: ConfigFileSnapshot[]; seen: Set<string> } {\n  const dir = path.dirname(configFilePath);\n  const resolvedConfig = path.resolve(configFilePath);\n  const snapshots: ConfigFileSnapshot[] = [{ path: resolvedConfig, content: configContent }];\n  const seen = new Set<string>([resolvedConfig]);\n  for (const specifier of getRelativeImportSpecifiers(configContent)) {\n    const resolved = path.resolve(dir, specifier);\n    if (!isPathInsideDir(dir, resolved)) continue;\n    captureSnapshotIfAbsent(snapshots, resolved, seen);\n  }\n  return { snapshots, seen };\n}\n\nfunction restoreConfigFiles(snapshots: ConfigFileSnapshot[]): void {\n  const failures: string[] = [];\n  for (const { path: filePath, content } of snapshots) {\n    try {\n      if (content === null) {\n        if (existsSync(filePath)) rmSync(filePath);\n      } else {\n        writeFileSync(filePath, content, \"utf-8\");\n      }\n    } catch (error) {\n      failures.push(`${filePath}: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  }\n  if (failures.length > 0) {\n    throw new Error(`Failed to restore ${failures.length} file(s) during rollback: ${failures.join(\"; \")}`);\n  }\n}\n\nasync function tryReadConfigForValidation(configFilePath: string): Promise<Config | null> {\n  try {\n    return (await readConfigFile(configFilePath)).config;\n  } catch (error) {\n    console.warn(`${LOG_PREFIX} Could not evaluate config for validation baseline; will fall back to a structural check`, {\n      configFilePath,\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return null;\n  }\n}\n\nasync function validateAgentUpdate(configFilePath: string, baselineConfig: Config | null, configUpdate: Config, snapshots: ConfigFileSnapshot[]): Promise<void> {\n  if (baselineConfig != null) {\n    const target = canonicalizeConfig(override(baselineConfig, configUpdate));\n    const result = canonicalizeConfig((await readConfigFile(configFilePath)).config);\n    if (!configsEqual(result, target)) {\n      throw new Error(`Config update validation failed for ${configFilePath}: the updated file does not evaluate to the expected configuration.`);\n    }\n    return;\n  }\n\n  // Structural-only fallback: when jiti can't evaluate the config (e.g. missing\n  // runtime dependencies in import-with attributes), we can only verify that\n  // (a) something changed on disk and (b) the file still exports `config`.\n  // This cannot catch silently mis-applied values — an accepted tradeoff vs.\n  // blocking updates entirely for configs we can't evaluate.\n  // When nothing changed on disk the update is either already applied or the\n  // agent couldn't figure out what to do. Treat it as a no-op rather than a\n  // hard failure: the structural check below still verifies the file is valid.\n  if (flattenConfigUpdate(configUpdate).length > 0 && !snapshotsChangedOnDisk(snapshots)) {\n    console.warn(`${LOG_PREFIX} Agent did not modify any file for ${configFilePath}; assuming values are already up to date.`);\n  }\n\n  const content = readFileSync(configFilePath, \"utf-8\");\n  if (!configFileExportsConfig(content, configFilePath)) {\n    throw new Error(`Config update validation failed for ${configFilePath}: the updated file no longer exports a valid \\`config\\`.`);\n  }\n}\n\nfunction tryParseStaticConfigFileContent(content: string, configFilePath: string): Config | null {\n  try {\n    const parsed = parseHexclaveConfigFileContent(content, configFilePath);\n    return isValidConfig(parsed) ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction configFileExportsConfig(content: string, configFilePath: string): boolean {\n  try {\n    parseHexclaveConfigFileContent(content, configFilePath);\n    return true;\n  } catch {\n    // Dynamic configs can be valid even when the static parser cannot evaluate\n    // them. For the structural fallback we only need to know that a runtime\n    // config binding still exists after the agent edited the file.\n    return /\\bexport\\s+const\\s+config\\b/.test(content);\n  }\n}\n\nfunction getRelativeImportSpecifiers(content: string): string[] {\n  const specifiers: string[] = [];\n  const importPattern = /\\bimport\\b(?:[^'\"]*?\\bfrom\\s*)?[\"'](\\.{1,2}\\/[^\"']+)[\"']/g;\n  let match: RegExpExecArray | null;\n  while ((match = importPattern.exec(content)) !== null) {\n    specifiers.push(match[1]);\n  }\n  return specifiers;\n}\n\nfunction snapshotsChangedOnDisk(snapshots: ConfigFileSnapshot[]): boolean {\n  return snapshots.some(({ path: filePath, content }) => {\n    const current = existsSync(filePath) ? readFileSync(filePath, \"utf-8\") : null;\n    return current !== content;\n  });\n}\n\nfunction flattenConfigUpdate(update: Config): ConfigChange[] {\n  const changes: ConfigChange[] = [];\n  const walk = (prefix: string, obj: Config): void => {\n    for (const [key, value] of Object.entries(obj)) {\n      const fullPath = prefix === \"\" ? key : `${prefix}.${key}`;\n      if (value === undefined) continue;\n      if (value !== null && typeof value === \"object\" && !Array.isArray(value) && Object.keys(value).length > 0) {\n        walk(fullPath, value);\n      } else {\n        changes.push({ path: fullPath, value });\n      }\n    }\n  };\n  walk(\"\", update);\n  return changes;\n}\n\nfunction buildConfigUpdatePrompt(configFileName: string, configUpdate: Config, baselineConfig: Config | null): string {\n  const changes = flattenConfigUpdate(configUpdate);\n  const changeLines = changes.map(({ path: configPath, value }) => {\n    return `- ${JSON.stringify(configPath)}: set to ${JSON.stringify(value)}`;\n  }).join(\"\\n\");\n  const expectedConfig = baselineConfig == null ? null : canonicalizeConfig(override(baselineConfig, configUpdate));\n  const expectedConfigSection = expectedConfig == null ? \"\" : `\nAfter the edit, evaluating the exported \\`config\\` must produce this exact JSON value:\n\n${JSON.stringify(expectedConfig, null, 2)}\n`;\n\n  return `You are editing a Hexclave / Stack Auth configuration file in place. Apply a set of configuration changes WITHOUT changing how the file is written.\n\nConfig file: ${JSON.stringify(configFileName)} (in the current working directory).\n\nThe file exports a \\`config\\` object (it may be wrapped in a helper such as \\`defineStackConfig(...)\\`). Some config values may be sourced from other files via imports, for example:\n\n    import welcomeEmail from \"./welcome-email.tsx\" with { type: \"text\" };\n    export const config = { emails: { templates: { welcome: welcomeEmail } } };\n\nApply EXACTLY these changes. Paths use dot notation, so \\`a.b.c\\` refers to \\`config.a.b.c\\`:\n\n${changeLines}\n${expectedConfigSection}\n\nRules:\n- Change ONLY the config paths listed above. Leave every other part of the file byte-for-byte unchanged: imports, comments, formatting, helper wrappers, and any config fields not listed.\n- If a listed path's value is currently provided by an imported external file (like the \\`import ... with { type: \"text\" }\\` example above), DO NOT inline the new value into the config file. Instead, overwrite that external file with the new value and keep the import statement intact.\n- If a listed path's value is a plain inline literal, edit it inline.\n- Keep the file valid: it must still export a \\`config\\` that, once evaluated, reflects the new values exactly.\n- Do not run any shell commands and do not create files other than what is required to apply these changes.`;\n}\n\nfunction canonicalizeConfig(config: Config): NormalizedConfig {\n  const droppedKeys: string[] = [];\n  const normalized = normalize(config, {\n    onDotIntoNonObject: \"ignore\",\n    onDotIntoNull: \"empty-object\",\n    droppedKeys,\n  });\n  if (droppedKeys.length > 0) {\n    throw new Error(`Config update has conflicting keys that would be dropped during normalization: ${droppedKeys.map((key) => JSON.stringify(key)).join(\", \")}`);\n  }\n  return normalized;\n}\n\nfunction configsEqual(a: unknown, b: unknown): boolean {\n  if (a === b) return true;\n  if (a === null || b === null) return a === b;\n  if (Array.isArray(a) || Array.isArray(b)) {\n    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;\n    return a.every((value, index) => configsEqual(value, b[index]));\n  }\n  if (typeof a === \"object\" && typeof b === \"object\") {\n    const aEntries = Object.entries(a);\n    const bMap = new Map(Object.entries(b));\n    if (aEntries.length !== bMap.size) return false;\n    return aEntries.every(([key, value]) => bMap.has(key) && configsEqual(value, bMap.get(key)));\n  }\n  return false;\n}\n"],"mappings":";;;;;;;;;;;AAWA,MAAM,OAAO,WAAW,OAAO,KAAK,KAAK,EAAE,aAAa,OAAO,CAAC;AAEhE,MAAM,aAAa;AACnB,MAAM,2BAA2B;AASjC,SAAS,eAAe,OAAuC;AAC7D,QAAO,UAAU,QAAQ,OAAO,UAAU;;AAG5C,SAAgB,aAAa,OAAuB;AAClD,QAAO,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;AAGzD,SAAgB,sBAAsB,WAA2B;CAC/D,MAAM,WAAW,KAAK,QAAQ,UAAU;AAExC,KAD4B,sBAAsB,KAAK,SAAS,CAE9D,QAAO;CAGT,MAAM,oBAAoB,KAAK,KAAK,UAAU,qBAAqB;CACnE,MAAM,kBAAkB,KAAK,KAAK,UAAU,kBAAkB;AAC9D,KAAI,WAAW,kBAAkB,CAC/B,QAAO;AAET,KAAI,WAAW,gBAAgB,CAC7B,QAAO;AAET,QAAO;;AAGT,SAAgB,uBAAuB,gBAA8B;AACnE,KAAI,WAAW,eAAe,CAAE;AAChC,WAAU,KAAK,QAAQ,eAAe,EAAE,EAAE,WAAW,MAAM,CAAC;AAC5D,0BAAyB,gBAAgB,EAAE,CAAC;;AAG9C,eAAsB,iBAAiB,gBAAyC;AAC9E,SAAQ,MAAM,eAAe,eAAe,EAAE;;AAGhD,eAAsB,eAAe,gBAA8E;AACjH,wBAAuB,eAAe;AAEtC,KADgB,aAAa,gBAAgB,QAAQ,CACzC,MAAM,KAAK,GACrB,QAAO;EACL,QAAQ,EAAE;EACV,gBAAgB;EACjB;CAGH,IAAI;AACJ,KAAI;AACF,iBAAe,MAAM,KAAK,OAAgB,eAAe;UAClD,OAAO;AAId,eAAa,iCAAiC,MAAM;AACpD,QAAM,IAAI,MACR,8BAA8B,eAAe,wSAC9C;;AAEH,KAAI,CAAC,eAAe,aAAa,CAC/B,OAAM,IAAI,MAAM,qBAAqB,eAAe,wEAAwE;CAG9H,MAAM,SAAS,aAAa;AAC5B,KAAI,WAAW,kCACb,QAAO;EACL,QAAQ,EAAE;EACV,gBAAgB;EACjB;AAEH,KAAI,CAAC,cAAc,OAAO,CACxB,OAAM,IAAI,MAAM,qBAAqB,eAAe,GAAG;AAEzD,QAAO;EACL;EACA,gBAAgB;EACjB;;AAGH,SAAS,2BAA2B,gBAAwB,QAAwB;AAElF,QAAO,wBAAwB,QADT,2BAA2B,KAAK,QAAQ,eAAe,CAAC,CACzB;;AAGvD,SAAS,gBAAgB,gBAAwB,SAAuB;CACtE,MAAM,MAAM,KAAK,QAAQ,eAAe;AACxC,WAAU,KAAK,EAAE,WAAW,MAAM,CAAC;CACnC,MAAM,WAAW,KAAK,KAAK,KAAK,iBAAiB,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM;AAC3F,eAAc,UAAU,SAAS,QAAQ;AACzC,KAAI;AACF,aAAW,UAAU,eAAe;UAC7B,OAAO;AACd,MAAI;AACF,UAAO,SAAS;UACV;AACR,QAAM;;;AAIV,SAAS,yBAAyB,gBAAwB,QAAsB;AAC9E,iBAAgB,gBAAgB,2BAA2B,gBAAgB,OAAO,CAAC;;AAGrF,eAAsB,mBAAmB,gBAAwB,cAAqC;AACpG,wBAAuB,eAAe;AAEtC,KAAI,oBAAoB,aAAa,CAAC,WAAW,EAAG;CAEpD,MAAM,UAAU,aAAa,gBAAgB,QAAQ;CAIrD,MAAM,eAAe,gCAAgC,SAAS,eAAe;AAC7E,KAAI,gBAAgB,QAAQ,cAAc,aAAa,EAAE;EACvD,MAAM,SAAS,SAAS,cAAc,aAAa;AACnD,MAAI,CAAC,cAAc,OAAO,CACxB,OAAM,IAAI,MAAM,GAAG,WAAW,qDAAqD,iBAAiB;AAEtG,2BAAyB,gBAAgB,OAAO;AAChD;;CAKF,MAAM,iBAAiB,MAAM,2BAA2B,eAAe;CACvE,MAAM,EAAE,WAAW,SAAS,oBAAoB,gBAAgB,QAAQ;AACxE,KAAI;AACF,QAAM,qBAAqB;GACzB,QAAQ,wBAAwB,KAAK,SAAS,eAAe,EAAE,cAAc,eAAe;GAC5F,KAAK,KAAK,QAAQ,eAAe;GACjC,mBAAmB,aAAa,wBAAwB,WAAW,UAAU,KAAK;GACnF,CAAC;AACF,QAAM,oBAAoB,gBAAgB,gBAAgB,cAAc,UAAU;UAC3E,OAAO;AACd,MAAI;AACF,sBAAmB,UAAU;WACtB,cAAc;AACrB,WAAQ,MAAM,GAAG,WAAW,mEAAmE,eAAe,yDAAyD;IACrK;IACA,cAAc,wBAAwB,QAAQ,aAAa,UAAU,OAAO,aAAa;IAC1F,CAAC;;AAEJ,QAAM;;;AAIV,eAAsB,oBAAoB,gBAAwB,QAA+B;AAC/F,0BAAyB,gBAAgB,OAAO;;AAGlD,eAAe,qBAAqB,SAIlB;CAChB,MAAM,YAAY,qBAAqB;CACvC,MAAM,0CAA0B,IAAI,KAAa;AACjD,KAAI;AACF,QAAM,uBAAuB;GAC3B,QAAQ,QAAQ;GAChB,KAAK,QAAQ;GACb,cAAc;IAAC;IAAQ;IAAS;IAAQ;IAAQ;IAAO;GACvD,iBAAiB;GACjB;GACA,SAAS,SAAS;AAAE,YAAQ,KAAK,GAAG,WAAW,WAAW,OAAO;;GACjE,eAAe,UAAU;IACvB,MAAM,SAAS,uBAAuB,MAAM,WAAW,MAAM,YAAY,QAAQ,IAAI;AACrF,QAAI,UAAU,KAAM,QAAO,EAAE,UAAU,MAAM;AAC7C,QAAI,CAAC,gBAAgB,QAAQ,KAAK,OAAO,EAAE;AACzC,6BAAwB,IAAI,OAAO;AACnC,YAAO,EACL,oBAAoB;MAClB,eAAe;MACf,oBAAoB;MACpB,0BAA0B,sBAAsB,OAAO;MACxD,EACF;;AAEH,YAAQ,mBAAmB,OAAO;AAClC,WAAO,EAAE,UAAU,MAAM;;GAE5B,CAAC;UACK,OAAO;AACd,MAAI,iBAAiB,wBACnB,OAAM,IAAI,MAAM,uCAAuC,UAAU,4DAA4D;AAE/H,MAAI,iBAAiB,wBACnB,OAAM,IAAI,MAAM,GAAG,MAAM,QAAQ,yDAAyD;AAE5F,QAAM;;AAER,KAAI,wBAAwB,OAAO,EACjC,OAAM,IAAI,MAAM,uCAAuC,wBAAwB,KAAK,+DAA+D,CAAC,GAAG,wBAAwB,CAAC,KAAK,KAAK,CAAC,+BAA+B;;AAI9N,SAAS,sBAA8B;CACrC,MAAM,MAAM,QAAQ,IAAI;AACxB,KAAI,OAAO,QAAQ,IAAI,MAAM,KAAK,GAAI,QAAO;CAC7C,MAAM,SAAS,OAAO,IAAI;AAC1B,KAAI,CAAC,OAAO,SAAS,OAAO,IAAI,UAAU,EACxC,OAAM,IAAI,MAAM,iDAAiD,KAAK,UAAU,IAAI,CAAC,+CAA+C;AAEtI,QAAO;;AAGT,SAAS,wBAAwB,WAAiC,UAAkB,MAAyB;CAC3G,MAAM,WAAW,KAAK,QAAQ,SAAS;AACvC,KAAI,KAAK,IAAI,SAAS,CAAE;AACxB,MAAK,IAAI,SAAS;AAClB,WAAU,KAAK;EAAE,MAAM;EAAU,SAAS,WAAW,SAAS,GAAG,aAAa,UAAU,QAAQ,GAAG;EAAM,CAAC;;AAG5G,SAAS,oBAAoB,gBAAwB,eAA+E;CAClI,MAAM,MAAM,KAAK,QAAQ,eAAe;CACxC,MAAM,iBAAiB,KAAK,QAAQ,eAAe;CACnD,MAAM,YAAkC,CAAC;EAAE,MAAM;EAAgB,SAAS;EAAe,CAAC;CAC1F,MAAM,OAAO,IAAI,IAAY,CAAC,eAAe,CAAC;AAC9C,MAAK,MAAM,aAAa,4BAA4B,cAAc,EAAE;EAClE,MAAM,WAAW,KAAK,QAAQ,KAAK,UAAU;AAC7C,MAAI,CAAC,gBAAgB,KAAK,SAAS,CAAE;AACrC,0BAAwB,WAAW,UAAU,KAAK;;AAEpD,QAAO;EAAE;EAAW;EAAM;;AAG5B,SAAS,mBAAmB,WAAuC;CACjE,MAAM,WAAqB,EAAE;AAC7B,MAAK,MAAM,EAAE,MAAM,UAAU,aAAa,UACxC,KAAI;AACF,MAAI,YAAY,MACd;OAAI,WAAW,SAAS,CAAE,QAAO,SAAS;QAE1C,eAAc,UAAU,SAAS,QAAQ;UAEpC,OAAO;AACd,WAAS,KAAK,GAAG,SAAS,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GAAG;;AAG3F,KAAI,SAAS,SAAS,EACpB,OAAM,IAAI,MAAM,qBAAqB,SAAS,OAAO,4BAA4B,SAAS,KAAK,KAAK,GAAG;;AAI3G,eAAe,2BAA2B,gBAAgD;AACxF,KAAI;AACF,UAAQ,MAAM,eAAe,eAAe,EAAE;UACvC,OAAO;AACd,UAAQ,KAAK,GAAG,WAAW,2FAA2F;GACpH;GACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC9D,CAAC;AACF,SAAO;;;AAIX,eAAe,oBAAoB,gBAAwB,gBAA+B,cAAsB,WAAgD;AAC9J,KAAI,kBAAkB,MAAM;EAC1B,MAAM,SAAS,mBAAmB,SAAS,gBAAgB,aAAa,CAAC;AAEzE,MAAI,CAAC,aADU,oBAAoB,MAAM,eAAe,eAAe,EAAE,OAAO,EACtD,OAAO,CAC/B,OAAM,IAAI,MAAM,uCAAuC,eAAe,qEAAqE;AAE7I;;AAWF,KAAI,oBAAoB,aAAa,CAAC,SAAS,KAAK,CAAC,uBAAuB,UAAU,CACpF,SAAQ,KAAK,GAAG,WAAW,qCAAqC,eAAe,2CAA2C;AAI5H,KAAI,CAAC,wBADW,aAAa,gBAAgB,QAAQ,EACf,eAAe,CACnD,OAAM,IAAI,MAAM,uCAAuC,eAAe,0DAA0D;;AAIpI,SAAS,gCAAgC,SAAiB,gBAAuC;AAC/F,KAAI;EACF,MAAM,SAAS,+BAA+B,SAAS,eAAe;AACtE,SAAO,cAAc,OAAO,GAAG,SAAS;SAClC;AACN,SAAO;;;AAIX,SAAS,wBAAwB,SAAiB,gBAAiC;AACjF,KAAI;AACF,iCAA+B,SAAS,eAAe;AACvD,SAAO;SACD;AAIN,SAAO,8BAA8B,KAAK,QAAQ;;;AAItD,SAAS,4BAA4B,SAA2B;CAC9D,MAAM,aAAuB,EAAE;CAC/B,MAAM,gBAAgB;CACtB,IAAI;AACJ,SAAQ,QAAQ,cAAc,KAAK,QAAQ,MAAM,KAC/C,YAAW,KAAK,MAAM,GAAG;AAE3B,QAAO;;AAGT,SAAS,uBAAuB,WAA0C;AACxE,QAAO,UAAU,MAAM,EAAE,MAAM,UAAU,cAAc;AAErD,UADgB,WAAW,SAAS,GAAG,aAAa,UAAU,QAAQ,GAAG,UACtD;GACnB;;AAGJ,SAAS,oBAAoB,QAAgC;CAC3D,MAAM,UAA0B,EAAE;CAClC,MAAM,QAAQ,QAAgB,QAAsB;AAClD,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,EAAE;GAC9C,MAAM,WAAW,WAAW,KAAK,MAAM,GAAG,OAAO,GAAG;AACpD,OAAI,UAAU,OAAW;AACzB,OAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC,SAAS,EACtG,MAAK,UAAU,MAAM;OAErB,SAAQ,KAAK;IAAE,MAAM;IAAU;IAAO,CAAC;;;AAI7C,MAAK,IAAI,OAAO;AAChB,QAAO;;AAGT,SAAS,wBAAwB,gBAAwB,cAAsB,gBAAuC;CAEpH,MAAM,cADU,oBAAoB,aAAa,CACrB,KAAK,EAAE,MAAM,YAAY,YAAY;AAC/D,SAAO,KAAK,KAAK,UAAU,WAAW,CAAC,WAAW,KAAK,UAAU,MAAM;GACvE,CAAC,KAAK,KAAK;CACb,MAAM,iBAAiB,kBAAkB,OAAO,OAAO,mBAAmB,SAAS,gBAAgB,aAAa,CAAC;CACjH,MAAM,wBAAwB,kBAAkB,OAAO,KAAK;;;EAG5D,KAAK,UAAU,gBAAgB,MAAM,EAAE,CAAC;;AAGxC,QAAO;;eAEM,KAAK,UAAU,eAAe,CAAC;;;;;;;;;EAS5C,YAAY;EACZ,sBAAsB;;;;;;;;;AAUxB,SAAS,mBAAmB,QAAkC;CAC5D,MAAM,cAAwB,EAAE;CAChC,MAAM,aAAa,UAAU,QAAQ;EACnC,oBAAoB;EACpB,eAAe;EACf;EACD,CAAC;AACF,KAAI,YAAY,SAAS,EACvB,OAAM,IAAI,MAAM,kFAAkF,YAAY,KAAK,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG;AAE/J,QAAO;;AAGT,SAAS,aAAa,GAAY,GAAqB;AACrD,KAAI,MAAM,EAAG,QAAO;AACpB,KAAI,MAAM,QAAQ,MAAM,KAAM,QAAO,MAAM;AAC3C,KAAI,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ,EAAE,EAAE;AACxC,MAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAC5E,SAAO,EAAE,OAAO,OAAO,UAAU,aAAa,OAAO,EAAE,OAAO,CAAC;;AAEjE,KAAI,OAAO,MAAM,YAAY,OAAO,MAAM,UAAU;EAClD,MAAM,WAAW,OAAO,QAAQ,EAAE;EAClC,MAAM,OAAO,IAAI,IAAI,OAAO,QAAQ,EAAE,CAAC;AACvC,MAAI,SAAS,WAAW,KAAK,KAAM,QAAO;AAC1C,SAAO,SAAS,OAAO,CAAC,KAAK,WAAW,KAAK,IAAI,IAAI,IAAI,aAAa,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC;;AAE9F,QAAO"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+import { Config } from "@hexclave/shared/dist/config/format";
+
+//#region src/index.d.ts
+declare function sha256String(value: string): string;
+declare function resolveConfigFilePath(inputPath: string): string;
+declare function ensureConfigFileExists(configFilePath: string): void;
+declare function readConfigObject(configFilePath: string): Promise<Config>;
+declare function readConfigFile(configFilePath: string): Promise<{
+  config: Config;
+  showOnboarding: boolean;
+}>;
+declare function updateConfigObject(configFilePath: string, configUpdate: Config): Promise<void>;
+declare function replaceConfigObject(configFilePath: string, config: Config): Promise<void>;
+//#endregion
+export { ensureConfigFileExists, readConfigFile, readConfigObject, replaceConfigObject, resolveConfigFilePath, sha256String, updateConfigObject };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";;;iBA2BgB,YAAA,CAAa,KAAA;AAAA,iBAIb,qBAAA,CAAsB,SAAA;AAAA,iBAkBtB,sBAAA,CAAuB,cAAA;AAAA,iBAMjB,gBAAA,CAAiB,cAAA,WAAyB,OAAA,CAAQ,MAAA;AAAA,iBAIlD,cAAA,CAAe,cAAA,WAAyB,OAAA;EAAU,MAAA,EAAQ,MAAA;EAAQ,cAAA;AAAA;AAAA,iBAkElE,kBAAA,CAAmB,cAAA,UAAwB,YAAA,EAAc,MAAA,GAAS,OAAA;AAAA,iBA2ClE,mBAAA,CAAoB,cAAA,UAAwB,MAAA,EAAQ,MAAA,GAAS,OAAA"}

package/dist/index.js

@@ -0,0 +1,336 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('./chunk-BE-pF4vm.js');
+let path = require("path");
+path = require_chunk.__toESM(path);
+let fs = require("fs");
+let _hexclave_shared_dist_config_authoring = require("@hexclave/shared/dist/config-authoring");
+let _hexclave_shared_dist_config_rendering = require("@hexclave/shared/dist/config-rendering");
+let _hexclave_shared_dist_config_format = require("@hexclave/shared/dist/config/format");
+let _hexclave_shared_dist_utils_errors = require("@hexclave/shared/dist/utils/errors");
+let crypto = require("crypto");
+let jiti = require("jiti");
+let __config_agent_js = require("./config-agent.js");
+
+//#region src/index.ts
+const jiti$1 = (0, jiti.createJiti)(require("url").pathToFileURL(__filename).href, { moduleCache: false });
+const LOG_PREFIX = "[Stack config updater]";
+const DEFAULT_AGENT_TIMEOUT_MS = 12e4;
+function isConfigModule(value) {
+	return value !== null && typeof value === "object";
+}
+function sha256String(value) {
+	return (0, crypto.createHash)("sha256").update(value).digest("hex");
+}
+function resolveConfigFilePath(inputPath) {
+	const resolved = path.default.resolve(inputPath);
+	if (/\.(ts|js|mjs|cjs)$/i.test(resolved)) return resolved;
+	const hexclaveCandidate = path.default.join(resolved, "hexclave.config.ts");
+	const legacyCandidate = path.default.join(resolved, "stack.config.ts");
+	if ((0, fs.existsSync)(hexclaveCandidate)) return hexclaveCandidate;
+	if ((0, fs.existsSync)(legacyCandidate)) return legacyCandidate;
+	return hexclaveCandidate;
+}
+function ensureConfigFileExists(configFilePath) {
+	if ((0, fs.existsSync)(configFilePath)) return;
+	(0, fs.mkdirSync)(path.default.dirname(configFilePath), { recursive: true });
+	renderConfigObjectToFile(configFilePath, {});
+}
+async function readConfigObject(configFilePath) {
+	return (await readConfigFile(configFilePath)).config;
+}
+async function readConfigFile(configFilePath) {
+	ensureConfigFileExists(configFilePath);
+	if ((0, fs.readFileSync)(configFilePath, "utf-8").trim() === "") return {
+		config: {},
+		showOnboarding: false
+	};
+	let configModule;
+	try {
+		configModule = await jiti$1.import(configFilePath);
+	} catch (error) {
+		(0, _hexclave_shared_dist_utils_errors.captureError)("shared-backend/readConfigFile", error);
+		throw new Error(`Failed to load config file ${configFilePath}. If your config imports a value (e.g. defineHexclaveConfig) from a framework package such as "@hexclave/next", import it from that package's lightweight "/config" entrypoint instead, which doesn't load the framework runtime:\n\n  import { defineHexclaveConfig } from "@hexclave/next/config";\n`);
+	}
+	if (!isConfigModule(configModule)) throw new Error(`Invalid config in ${configFilePath}. The file must export a plain \`config\` object or "show-onboarding".`);
+	const config = configModule.config;
+	if (config === _hexclave_shared_dist_config_authoring.showOnboardingHexclaveConfigValue) return {
+		config: {},
+		showOnboarding: true
+	};
+	if (!(0, _hexclave_shared_dist_config_format.isValidConfig)(config)) throw new Error(`Invalid config in ${configFilePath}.`);
+	return {
+		config,
+		showOnboarding: false
+	};
+}
+function renderConfigObjectToString(configFilePath, config) {
+	return (0, _hexclave_shared_dist_config_rendering.renderConfigFileContent)(config, (0, _hexclave_shared_dist_config_rendering.detectImportPackageFromDir)(path.default.dirname(configFilePath)));
+}
+function writeFileAtomic(configFilePath, content) {
+	const dir = path.default.dirname(configFilePath);
+	(0, fs.mkdirSync)(dir, { recursive: true });
+	const tempPath = path.default.join(dir, `.stack.config.${Math.random().toString(36).slice(2)}.tmp`);
+	(0, fs.writeFileSync)(tempPath, content, "utf-8");
+	try {
+		(0, fs.renameSync)(tempPath, configFilePath);
+	} catch (error) {
+		try {
+			(0, fs.rmSync)(tempPath);
+		} catch {}
+		throw error;
+	}
+}
+function renderConfigObjectToFile(configFilePath, config) {
+	writeFileAtomic(configFilePath, renderConfigObjectToString(configFilePath, config));
+}
+async function updateConfigObject(configFilePath, configUpdate) {
+	ensureConfigFileExists(configFilePath);
+	if (flattenConfigUpdate(configUpdate).length === 0) return;
+	const content = (0, fs.readFileSync)(configFilePath, "utf-8");
+	const staticConfig = tryParseStaticConfigFileContent(content, configFilePath);
+	if (staticConfig != null && (0, _hexclave_shared_dist_config_format.isValidConfig)(staticConfig)) {
+		const merged = (0, _hexclave_shared_dist_config_format.override)(staticConfig, configUpdate);
+		if (!(0, _hexclave_shared_dist_config_format.isValidConfig)(merged)) throw new Error(`${LOG_PREFIX} Merged config is invalid after applying update to ${configFilePath}`);
+		renderConfigObjectToFile(configFilePath, merged);
+		return;
+	}
+	const baselineConfig = await tryReadConfigForValidation(configFilePath);
+	const { snapshots, seen } = snapshotConfigFiles(configFilePath, content);
+	try {
+		await runConfigUpdateAgent({
+			prompt: buildConfigUpdatePrompt(path.default.basename(configFilePath), configUpdate, baselineConfig),
+			cwd: path.default.dirname(configFilePath),
+			onFileWillChange: (filePath) => captureSnapshotIfAbsent(snapshots, filePath, seen)
+		});
+		await validateAgentUpdate(configFilePath, baselineConfig, configUpdate, snapshots);
+	} catch (error) {
+		try {
+			restoreConfigFiles(snapshots);
+		} catch (restoreError) {
+			console.error(`${LOG_PREFIX} Failed to fully roll back config files after a failed update of ${configFilePath}; some files may be left in a partially-restored state`, {
+				configFilePath,
+				restoreError: restoreError instanceof Error ? restoreError.message : String(restoreError)
+			});
+		}
+		throw error;
+	}
+}
+async function replaceConfigObject(configFilePath, config) {
+	renderConfigObjectToFile(configFilePath, config);
+}
+async function runConfigUpdateAgent(options) {
+	const timeoutMs = parseAgentTimeoutMs();
+	const deniedOutOfBoundsWrites = /* @__PURE__ */ new Set();
+	try {
+		await (0, __config_agent_js.runHeadlessClaudeAgent)({
+			prompt: options.prompt,
+			cwd: options.cwd,
+			allowedTools: [
+				"Read",
+				"Write",
+				"Edit",
+				"Glob",
+				"Grep"
+			],
+			strictIsolation: true,
+			timeoutMs,
+			stderr: (data) => {
+				console.warn(`${LOG_PREFIX} [agent] ${data}`);
+			},
+			onPreToolUse: (input) => {
+				const target = (0, __config_agent_js.getToolWriteTargetPath)(input.tool_name, input.tool_input, options.cwd);
+				if (target == null) return { continue: true };
+				if (!(0, __config_agent_js.isPathInsideDir)(options.cwd, target)) {
+					deniedOutOfBoundsWrites.add(target);
+					return { hookSpecificOutput: {
+						hookEventName: "PreToolUse",
+						permissionDecision: "deny",
+						permissionDecisionReason: `Refusing to modify ${target}: config updates may only change files inside the config directory.`
+					} };
+				}
+				options.onFileWillChange?.(target);
+				return { continue: true };
+			}
+		});
+	} catch (error) {
+		if (error instanceof __config_agent_js.ClaudeAgentTimeoutError) throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);
+		if (error instanceof __config_agent_js.ClaudeAgentFailureError) throw new Error(`${error.message} It was unable to apply the config changes to the file.`);
+		throw error;
+	}
+	if (deniedOutOfBoundsWrites.size > 0) throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(", ")}. The config was not updated.`);
+}
+function parseAgentTimeoutMs() {
+	const raw = process.env.STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS;
+	if (raw == null || raw.trim() === "") return DEFAULT_AGENT_TIMEOUT_MS;
+	const parsed = Number(raw);
+	if (!Number.isFinite(parsed) || parsed <= 0) throw new Error(`Invalid STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS: ${JSON.stringify(raw)}. Expected a positive number of milliseconds.`);
+	return parsed;
+}
+function captureSnapshotIfAbsent(snapshots, filePath, seen) {
+	const resolved = path.default.resolve(filePath);
+	if (seen.has(resolved)) return;
+	seen.add(resolved);
+	snapshots.push({
+		path: resolved,
+		content: (0, fs.existsSync)(resolved) ? (0, fs.readFileSync)(resolved, "utf-8") : null
+	});
+}
+function snapshotConfigFiles(configFilePath, configContent) {
+	const dir = path.default.dirname(configFilePath);
+	const resolvedConfig = path.default.resolve(configFilePath);
+	const snapshots = [{
+		path: resolvedConfig,
+		content: configContent
+	}];
+	const seen = new Set([resolvedConfig]);
+	for (const specifier of getRelativeImportSpecifiers(configContent)) {
+		const resolved = path.default.resolve(dir, specifier);
+		if (!(0, __config_agent_js.isPathInsideDir)(dir, resolved)) continue;
+		captureSnapshotIfAbsent(snapshots, resolved, seen);
+	}
+	return {
+		snapshots,
+		seen
+	};
+}
+function restoreConfigFiles(snapshots) {
+	const failures = [];
+	for (const { path: filePath, content } of snapshots) try {
+		if (content === null) {
+			if ((0, fs.existsSync)(filePath)) (0, fs.rmSync)(filePath);
+		} else (0, fs.writeFileSync)(filePath, content, "utf-8");
+	} catch (error) {
+		failures.push(`${filePath}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (failures.length > 0) throw new Error(`Failed to restore ${failures.length} file(s) during rollback: ${failures.join("; ")}`);
+}
+async function tryReadConfigForValidation(configFilePath) {
+	try {
+		return (await readConfigFile(configFilePath)).config;
+	} catch (error) {
+		console.warn(`${LOG_PREFIX} Could not evaluate config for validation baseline; will fall back to a structural check`, {
+			configFilePath,
+			error: error instanceof Error ? error.message : String(error)
+		});
+		return null;
+	}
+}
+async function validateAgentUpdate(configFilePath, baselineConfig, configUpdate, snapshots) {
+	if (baselineConfig != null) {
+		const target = canonicalizeConfig((0, _hexclave_shared_dist_config_format.override)(baselineConfig, configUpdate));
+		if (!configsEqual(canonicalizeConfig((await readConfigFile(configFilePath)).config), target)) throw new Error(`Config update validation failed for ${configFilePath}: the updated file does not evaluate to the expected configuration.`);
+		return;
+	}
+	if (flattenConfigUpdate(configUpdate).length > 0 && !snapshotsChangedOnDisk(snapshots)) console.warn(`${LOG_PREFIX} Agent did not modify any file for ${configFilePath}; assuming values are already up to date.`);
+	if (!configFileExportsConfig((0, fs.readFileSync)(configFilePath, "utf-8"), configFilePath)) throw new Error(`Config update validation failed for ${configFilePath}: the updated file no longer exports a valid \`config\`.`);
+}
+function tryParseStaticConfigFileContent(content, configFilePath) {
+	try {
+		const parsed = (0, _hexclave_shared_dist_config_rendering.parseHexclaveConfigFileContent)(content, configFilePath);
+		return (0, _hexclave_shared_dist_config_format.isValidConfig)(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function configFileExportsConfig(content, configFilePath) {
+	try {
+		(0, _hexclave_shared_dist_config_rendering.parseHexclaveConfigFileContent)(content, configFilePath);
+		return true;
+	} catch {
+		return /\bexport\s+const\s+config\b/.test(content);
+	}
+}
+function getRelativeImportSpecifiers(content) {
+	const specifiers = [];
+	const importPattern = /\bimport\b(?:[^'"]*?\bfrom\s*)?["'](\.{1,2}\/[^"']+)["']/g;
+	let match;
+	while ((match = importPattern.exec(content)) !== null) specifiers.push(match[1]);
+	return specifiers;
+}
+function snapshotsChangedOnDisk(snapshots) {
+	return snapshots.some(({ path: filePath, content }) => {
+		return ((0, fs.existsSync)(filePath) ? (0, fs.readFileSync)(filePath, "utf-8") : null) !== content;
+	});
+}
+function flattenConfigUpdate(update) {
+	const changes = [];
+	const walk = (prefix, obj) => {
+		for (const [key, value] of Object.entries(obj)) {
+			const fullPath = prefix === "" ? key : `${prefix}.${key}`;
+			if (value === void 0) continue;
+			if (value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length > 0) walk(fullPath, value);
+			else changes.push({
+				path: fullPath,
+				value
+			});
+		}
+	};
+	walk("", update);
+	return changes;
+}
+function buildConfigUpdatePrompt(configFileName, configUpdate, baselineConfig) {
+	const changeLines = flattenConfigUpdate(configUpdate).map(({ path: configPath, value }) => {
+		return `- ${JSON.stringify(configPath)}: set to ${JSON.stringify(value)}`;
+	}).join("\n");
+	const expectedConfig = baselineConfig == null ? null : canonicalizeConfig((0, _hexclave_shared_dist_config_format.override)(baselineConfig, configUpdate));
+	const expectedConfigSection = expectedConfig == null ? "" : `
+After the edit, evaluating the exported \`config\` must produce this exact JSON value:
+
+${JSON.stringify(expectedConfig, null, 2)}
+`;
+	return `You are editing a Hexclave / Stack Auth configuration file in place. Apply a set of configuration changes WITHOUT changing how the file is written.
+
+Config file: ${JSON.stringify(configFileName)} (in the current working directory).
+
+The file exports a \`config\` object (it may be wrapped in a helper such as \`defineStackConfig(...)\`). Some config values may be sourced from other files via imports, for example:
+
+    import welcomeEmail from "./welcome-email.tsx" with { type: "text" };
+    export const config = { emails: { templates: { welcome: welcomeEmail } } };
+
+Apply EXACTLY these changes. Paths use dot notation, so \`a.b.c\` refers to \`config.a.b.c\`:
+
+${changeLines}
+${expectedConfigSection}
+
+Rules:
+- Change ONLY the config paths listed above. Leave every other part of the file byte-for-byte unchanged: imports, comments, formatting, helper wrappers, and any config fields not listed.
+- If a listed path's value is currently provided by an imported external file (like the \`import ... with { type: "text" }\` example above), DO NOT inline the new value into the config file. Instead, overwrite that external file with the new value and keep the import statement intact.
+- If a listed path's value is a plain inline literal, edit it inline.
+- Keep the file valid: it must still export a \`config\` that, once evaluated, reflects the new values exactly.
+- Do not run any shell commands and do not create files other than what is required to apply these changes.`;
+}
+function canonicalizeConfig(config) {
+	const droppedKeys = [];
+	const normalized = (0, _hexclave_shared_dist_config_format.normalize)(config, {
+		onDotIntoNonObject: "ignore",
+		onDotIntoNull: "empty-object",
+		droppedKeys
+	});
+	if (droppedKeys.length > 0) throw new Error(`Config update has conflicting keys that would be dropped during normalization: ${droppedKeys.map((key) => JSON.stringify(key)).join(", ")}`);
+	return normalized;
+}
+function configsEqual(a, b) {
+	if (a === b) return true;
+	if (a === null || b === null) return a === b;
+	if (Array.isArray(a) || Array.isArray(b)) {
+		if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+		return a.every((value, index) => configsEqual(value, b[index]));
+	}
+	if (typeof a === "object" && typeof b === "object") {
+		const aEntries = Object.entries(a);
+		const bMap = new Map(Object.entries(b));
+		if (aEntries.length !== bMap.size) return false;
+		return aEntries.every(([key, value]) => bMap.has(key) && configsEqual(value, bMap.get(key)));
+	}
+	return false;
+}
+
+//#endregion
+exports.ensureConfigFileExists = ensureConfigFileExists;
+exports.readConfigFile = readConfigFile;
+exports.readConfigObject = readConfigObject;
+exports.replaceConfigObject = replaceConfigObject;
+exports.resolveConfigFilePath = resolveConfigFilePath;
+exports.sha256String = sha256String;
+exports.updateConfigObject = updateConfigObject;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["jiti","showOnboardingHexclaveConfigValue","ClaudeAgentTimeoutError","ClaudeAgentFailureError"],"sources":["../src/index.ts"],"sourcesContent":["import { showOnboardingHexclaveConfigValue } from \"@hexclave/shared/dist/config-authoring\";\nimport { detectImportPackageFromDir, parseHexclaveConfigFileContent, renderConfigFileContent } from \"@hexclave/shared/dist/config-rendering\";\nimport type { Config, ConfigValue, NormalizedConfig } from \"@hexclave/shared/dist/config/format\";\nimport { isValidConfig, normalize, override } from \"@hexclave/shared/dist/config/format\";\nimport { captureError } from \"@hexclave/shared/dist/utils/errors\";\nimport { createHash } from \"crypto\";\nimport { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from \"fs\";\nimport { createJiti } from \"jiti\";\nimport path from \"path\";\nimport { ClaudeAgentFailureError, ClaudeAgentTimeoutError, getToolWriteTargetPath, isPathInsideDir, runHeadlessClaudeAgent } from \"./config-agent\";\n\nconst jiti = createJiti(import.meta.url, { moduleCache: false });\n\nconst LOG_PREFIX = \"[Stack config updater]\";\nconst DEFAULT_AGENT_TIMEOUT_MS = 120_000;\n\ntype ConfigModule = {\n  config?: unknown,\n};\n\ntype ConfigFileSnapshot = { path: string, content: string | null };\ntype ConfigChange = { path: string, value: ConfigValue };\n\nfunction isConfigModule(value: unknown): value is ConfigModule {\n  return value !== null && typeof value === \"object\";\n}\n\nexport function sha256String(value: string): string {\n  return createHash(\"sha256\").update(value).digest(\"hex\");\n}\n\nexport function resolveConfigFilePath(inputPath: string): string {\n  const resolved = path.resolve(inputPath);\n  const looksLikeConfigFile = /\\.(ts|js|mjs|cjs)$/i.test(resolved);\n  if (looksLikeConfigFile) {\n    return resolved;\n  }\n  // Prefer hexclave.config.ts, fall back to stack.config.ts, default to the new name.\n  const hexclaveCandidate = path.join(resolved, \"hexclave.config.ts\");\n  const legacyCandidate = path.join(resolved, \"stack.config.ts\");\n  if (existsSync(hexclaveCandidate)) {\n    return hexclaveCandidate;\n  }\n  if (existsSync(legacyCandidate)) {\n    return legacyCandidate;\n  }\n  return hexclaveCandidate;\n}\n\nexport function ensureConfigFileExists(configFilePath: string): void {\n  if (existsSync(configFilePath)) return;\n  mkdirSync(path.dirname(configFilePath), { recursive: true });\n  renderConfigObjectToFile(configFilePath, {});\n}\n\nexport async function readConfigObject(configFilePath: string): Promise<Config> {\n  return (await readConfigFile(configFilePath)).config;\n}\n\nexport async function readConfigFile(configFilePath: string): Promise<{ config: Config, showOnboarding: boolean }> {\n  ensureConfigFileExists(configFilePath);\n  const content = readFileSync(configFilePath, \"utf-8\");\n  if (content.trim() === \"\") {\n    return {\n      config: {},\n      showOnboarding: false,\n    };\n  }\n\n  let configModule: unknown;\n  try {\n    configModule = await jiti.import<unknown>(configFilePath);\n  } catch (error) {\n    // Capture the raw jiti/framework error for diagnostics, but don't attach it as `cause` on the thrown error:\n    // dashboard error formatting renders causes recursively, which would leak framework internals into the\n    // user-facing message we're deliberately replacing.\n    captureError(\"shared-backend/readConfigFile\", error);\n    throw new Error(\n      `Failed to load config file ${configFilePath}. If your config imports a value (e.g. defineHexclaveConfig) from a framework package such as \"@hexclave/next\", import it from that package's lightweight \"/config\" entrypoint instead, which doesn't load the framework runtime:\\n\\n  import { defineHexclaveConfig } from \"@hexclave/next/config\";\\n`,\n    );\n  }\n  if (!isConfigModule(configModule)) {\n    throw new Error(`Invalid config in ${configFilePath}. The file must export a plain \\`config\\` object or \"show-onboarding\".`);\n  }\n\n  const config = configModule.config;\n  if (config === showOnboardingHexclaveConfigValue) {\n    return {\n      config: {},\n      showOnboarding: true,\n    };\n  }\n  if (!isValidConfig(config)) {\n    throw new Error(`Invalid config in ${configFilePath}.`);\n  }\n  return {\n    config,\n    showOnboarding: false,\n  };\n}\n\nfunction renderConfigObjectToString(configFilePath: string, config: Config): string {\n  const importPackage = detectImportPackageFromDir(path.dirname(configFilePath));\n  return renderConfigFileContent(config, importPackage);\n}\n\nfunction writeFileAtomic(configFilePath: string, content: string): void {\n  const dir = path.dirname(configFilePath);\n  mkdirSync(dir, { recursive: true });\n  const tempPath = path.join(dir, `.stack.config.${Math.random().toString(36).slice(2)}.tmp`);\n  writeFileSync(tempPath, content, \"utf-8\");\n  try {\n    renameSync(tempPath, configFilePath);\n  } catch (error) {\n    try {\n      rmSync(tempPath);\n    } catch { /* best-effort cleanup */ }\n    throw error;\n  }\n}\n\nfunction renderConfigObjectToFile(configFilePath: string, config: Config): void {\n  writeFileAtomic(configFilePath, renderConfigObjectToString(configFilePath, config));\n}\n\nexport async function updateConfigObject(configFilePath: string, configUpdate: Config): Promise<void> {\n  ensureConfigFileExists(configFilePath);\n\n  if (flattenConfigUpdate(configUpdate).length === 0) return;\n\n  const content = readFileSync(configFilePath, \"utf-8\");\n\n  // Fast path: if the config is a plain static literal (no imports, no helpers),\n  // apply the update deterministically without invoking the AI agent.\n  const staticConfig = tryParseStaticConfigFileContent(content, configFilePath);\n  if (staticConfig != null && isValidConfig(staticConfig)) {\n    const merged = override(staticConfig, configUpdate);\n    if (!isValidConfig(merged)) {\n      throw new Error(`${LOG_PREFIX} Merged config is invalid after applying update to ${configFilePath}`);\n    }\n    renderConfigObjectToFile(configFilePath, merged);\n    return;\n  }\n\n  // Agent path: config has custom structure (imports, helpers, external files)\n  // that must be preserved — delegate to the AI agent.\n  const baselineConfig = await tryReadConfigForValidation(configFilePath);\n  const { snapshots, seen } = snapshotConfigFiles(configFilePath, content);\n  try {\n    await runConfigUpdateAgent({\n      prompt: buildConfigUpdatePrompt(path.basename(configFilePath), configUpdate, baselineConfig),\n      cwd: path.dirname(configFilePath),\n      onFileWillChange: (filePath) => captureSnapshotIfAbsent(snapshots, filePath, seen),\n    });\n    await validateAgentUpdate(configFilePath, baselineConfig, configUpdate, snapshots);\n  } catch (error) {\n    try {\n      restoreConfigFiles(snapshots);\n    } catch (restoreError) {\n      console.error(`${LOG_PREFIX} Failed to fully roll back config files after a failed update of ${configFilePath}; some files may be left in a partially-restored state`, {\n        configFilePath,\n        restoreError: restoreError instanceof Error ? restoreError.message : String(restoreError),\n      });\n    }\n    throw error;\n  }\n}\n\nexport async function replaceConfigObject(configFilePath: string, config: Config): Promise<void> {\n  renderConfigObjectToFile(configFilePath, config);\n}\n\nasync function runConfigUpdateAgent(options: {\n  prompt: string,\n  cwd: string,\n  onFileWillChange?: (filePath: string) => void,\n}): Promise<void> {\n  const timeoutMs = parseAgentTimeoutMs();\n  const deniedOutOfBoundsWrites = new Set<string>();\n  try {\n    await runHeadlessClaudeAgent({\n      prompt: options.prompt,\n      cwd: options.cwd,\n      allowedTools: [\"Read\", \"Write\", \"Edit\", \"Glob\", \"Grep\"],\n      strictIsolation: true,\n      timeoutMs,\n      stderr: (data) => { console.warn(`${LOG_PREFIX} [agent] ${data}`); },\n      onPreToolUse: (input) => {\n        const target = getToolWriteTargetPath(input.tool_name, input.tool_input, options.cwd);\n        if (target == null) return { continue: true };\n        if (!isPathInsideDir(options.cwd, target)) {\n          deniedOutOfBoundsWrites.add(target);\n          return {\n            hookSpecificOutput: {\n              hookEventName: \"PreToolUse\",\n              permissionDecision: \"deny\",\n              permissionDecisionReason: `Refusing to modify ${target}: config updates may only change files inside the config directory.`,\n            },\n          };\n        }\n        options.onFileWillChange?.(target);\n        return { continue: true };\n      },\n    });\n  } catch (error) {\n    if (error instanceof ClaudeAgentTimeoutError) {\n      throw new Error(`Config update agent timed out after ${timeoutMs}ms. It was unable to apply the config changes to the file.`);\n    }\n    if (error instanceof ClaudeAgentFailureError) {\n      throw new Error(`${error.message} It was unable to apply the config changes to the file.`);\n    }\n    throw error;\n  }\n  if (deniedOutOfBoundsWrites.size > 0) {\n    throw new Error(`Config update agent tried to modify ${deniedOutOfBoundsWrites.size} file(s) outside the config directory, which is not allowed: ${[...deniedOutOfBoundsWrites].join(\", \")}. The config was not updated.`);\n  }\n}\n\nfunction parseAgentTimeoutMs(): number {\n  const raw = process.env.STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS;\n  if (raw == null || raw.trim() === \"\") return DEFAULT_AGENT_TIMEOUT_MS;\n  const parsed = Number(raw);\n  if (!Number.isFinite(parsed) || parsed <= 0) {\n    throw new Error(`Invalid STACK_CONFIG_UPDATE_AGENT_TIMEOUT_MS: ${JSON.stringify(raw)}. Expected a positive number of milliseconds.`);\n  }\n  return parsed;\n}\n\nfunction captureSnapshotIfAbsent(snapshots: ConfigFileSnapshot[], filePath: string, seen: Set<string>): void {\n  const resolved = path.resolve(filePath);\n  if (seen.has(resolved)) return;\n  seen.add(resolved);\n  snapshots.push({ path: resolved, content: existsSync(resolved) ? readFileSync(resolved, \"utf-8\") : null });\n}\n\nfunction snapshotConfigFiles(configFilePath: string, configContent: string): { snapshots: ConfigFileSnapshot[]; seen: Set<string> } {\n  const dir = path.dirname(configFilePath);\n  const resolvedConfig = path.resolve(configFilePath);\n  const snapshots: ConfigFileSnapshot[] = [{ path: resolvedConfig, content: configContent }];\n  const seen = new Set<string>([resolvedConfig]);\n  for (const specifier of getRelativeImportSpecifiers(configContent)) {\n    const resolved = path.resolve(dir, specifier);\n    if (!isPathInsideDir(dir, resolved)) continue;\n    captureSnapshotIfAbsent(snapshots, resolved, seen);\n  }\n  return { snapshots, seen };\n}\n\nfunction restoreConfigFiles(snapshots: ConfigFileSnapshot[]): void {\n  const failures: string[] = [];\n  for (const { path: filePath, content } of snapshots) {\n    try {\n      if (content === null) {\n        if (existsSync(filePath)) rmSync(filePath);\n      } else {\n        writeFileSync(filePath, content, \"utf-8\");\n      }\n    } catch (error) {\n      failures.push(`${filePath}: ${error instanceof Error ? error.message : String(error)}`);\n    }\n  }\n  if (failures.length > 0) {\n    throw new Error(`Failed to restore ${failures.length} file(s) during rollback: ${failures.join(\"; \")}`);\n  }\n}\n\nasync function tryReadConfigForValidation(configFilePath: string): Promise<Config | null> {\n  try {\n    return (await readConfigFile(configFilePath)).config;\n  } catch (error) {\n    console.warn(`${LOG_PREFIX} Could not evaluate config for validation baseline; will fall back to a structural check`, {\n      configFilePath,\n      error: error instanceof Error ? error.message : String(error),\n    });\n    return null;\n  }\n}\n\nasync function validateAgentUpdate(configFilePath: string, baselineConfig: Config | null, configUpdate: Config, snapshots: ConfigFileSnapshot[]): Promise<void> {\n  if (baselineConfig != null) {\n    const target = canonicalizeConfig(override(baselineConfig, configUpdate));\n    const result = canonicalizeConfig((await readConfigFile(configFilePath)).config);\n    if (!configsEqual(result, target)) {\n      throw new Error(`Config update validation failed for ${configFilePath}: the updated file does not evaluate to the expected configuration.`);\n    }\n    return;\n  }\n\n  // Structural-only fallback: when jiti can't evaluate the config (e.g. missing\n  // runtime dependencies in import-with attributes), we can only verify that\n  // (a) something changed on disk and (b) the file still exports `config`.\n  // This cannot catch silently mis-applied values — an accepted tradeoff vs.\n  // blocking updates entirely for configs we can't evaluate.\n  // When nothing changed on disk the update is either already applied or the\n  // agent couldn't figure out what to do. Treat it as a no-op rather than a\n  // hard failure: the structural check below still verifies the file is valid.\n  if (flattenConfigUpdate(configUpdate).length > 0 && !snapshotsChangedOnDisk(snapshots)) {\n    console.warn(`${LOG_PREFIX} Agent did not modify any file for ${configFilePath}; assuming values are already up to date.`);\n  }\n\n  const content = readFileSync(configFilePath, \"utf-8\");\n  if (!configFileExportsConfig(content, configFilePath)) {\n    throw new Error(`Config update validation failed for ${configFilePath}: the updated file no longer exports a valid \\`config\\`.`);\n  }\n}\n\nfunction tryParseStaticConfigFileContent(content: string, configFilePath: string): Config | null {\n  try {\n    const parsed = parseHexclaveConfigFileContent(content, configFilePath);\n    return isValidConfig(parsed) ? parsed : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction configFileExportsConfig(content: string, configFilePath: string): boolean {\n  try {\n    parseHexclaveConfigFileContent(content, configFilePath);\n    return true;\n  } catch {\n    // Dynamic configs can be valid even when the static parser cannot evaluate\n    // them. For the structural fallback we only need to know that a runtime\n    // config binding still exists after the agent edited the file.\n    return /\\bexport\\s+const\\s+config\\b/.test(content);\n  }\n}\n\nfunction getRelativeImportSpecifiers(content: string): string[] {\n  const specifiers: string[] = [];\n  const importPattern = /\\bimport\\b(?:[^'\"]*?\\bfrom\\s*)?[\"'](\\.{1,2}\\/[^\"']+)[\"']/g;\n  let match: RegExpExecArray | null;\n  while ((match = importPattern.exec(content)) !== null) {\n    specifiers.push(match[1]);\n  }\n  return specifiers;\n}\n\nfunction snapshotsChangedOnDisk(snapshots: ConfigFileSnapshot[]): boolean {\n  return snapshots.some(({ path: filePath, content }) => {\n    const current = existsSync(filePath) ? readFileSync(filePath, \"utf-8\") : null;\n    return current !== content;\n  });\n}\n\nfunction flattenConfigUpdate(update: Config): ConfigChange[] {\n  const changes: ConfigChange[] = [];\n  const walk = (prefix: string, obj: Config): void => {\n    for (const [key, value] of Object.entries(obj)) {\n      const fullPath = prefix === \"\" ? key : `${prefix}.${key}`;\n      if (value === undefined) continue;\n      if (value !== null && typeof value === \"object\" && !Array.isArray(value) && Object.keys(value).length > 0) {\n        walk(fullPath, value);\n      } else {\n        changes.push({ path: fullPath, value });\n      }\n    }\n  };\n  walk(\"\", update);\n  return changes;\n}\n\nfunction buildConfigUpdatePrompt(configFileName: string, configUpdate: Config, baselineConfig: Config | null): string {\n  const changes = flattenConfigUpdate(configUpdate);\n  const changeLines = changes.map(({ path: configPath, value }) => {\n    return `- ${JSON.stringify(configPath)}: set to ${JSON.stringify(value)}`;\n  }).join(\"\\n\");\n  const expectedConfig = baselineConfig == null ? null : canonicalizeConfig(override(baselineConfig, configUpdate));\n  const expectedConfigSection = expectedConfig == null ? \"\" : `\nAfter the edit, evaluating the exported \\`config\\` must produce this exact JSON value:\n\n${JSON.stringify(expectedConfig, null, 2)}\n`;\n\n  return `You are editing a Hexclave / Stack Auth configuration file in place. Apply a set of configuration changes WITHOUT changing how the file is written.\n\nConfig file: ${JSON.stringify(configFileName)} (in the current working directory).\n\nThe file exports a \\`config\\` object (it may be wrapped in a helper such as \\`defineStackConfig(...)\\`). Some config values may be sourced from other files via imports, for example:\n\n    import welcomeEmail from \"./welcome-email.tsx\" with { type: \"text\" };\n    export const config = { emails: { templates: { welcome: welcomeEmail } } };\n\nApply EXACTLY these changes. Paths use dot notation, so \\`a.b.c\\` refers to \\`config.a.b.c\\`:\n\n${changeLines}\n${expectedConfigSection}\n\nRules:\n- Change ONLY the config paths listed above. Leave every other part of the file byte-for-byte unchanged: imports, comments, formatting, helper wrappers, and any config fields not listed.\n- If a listed path's value is currently provided by an imported external file (like the \\`import ... with { type: \"text\" }\\` example above), DO NOT inline the new value into the config file. Instead, overwrite that external file with the new value and keep the import statement intact.\n- If a listed path's value is a plain inline literal, edit it inline.\n- Keep the file valid: it must still export a \\`config\\` that, once evaluated, reflects the new values exactly.\n- Do not run any shell commands and do not create files other than what is required to apply these changes.`;\n}\n\nfunction canonicalizeConfig(config: Config): NormalizedConfig {\n  const droppedKeys: string[] = [];\n  const normalized = normalize(config, {\n    onDotIntoNonObject: \"ignore\",\n    onDotIntoNull: \"empty-object\",\n    droppedKeys,\n  });\n  if (droppedKeys.length > 0) {\n    throw new Error(`Config update has conflicting keys that would be dropped during normalization: ${droppedKeys.map((key) => JSON.stringify(key)).join(\", \")}`);\n  }\n  return normalized;\n}\n\nfunction configsEqual(a: unknown, b: unknown): boolean {\n  if (a === b) return true;\n  if (a === null || b === null) return a === b;\n  if (Array.isArray(a) || Array.isArray(b)) {\n    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;\n    return a.every((value, index) => configsEqual(value, b[index]));\n  }\n  if (typeof a === \"object\" && typeof b === \"object\") {\n    const aEntries = Object.entries(a);\n    const bMap = new Map(Object.entries(b));\n    if (aEntries.length !== bMap.size) return false;\n    return aEntries.every(([key, value]) => bMap.has(key) && configsEqual(value, bMap.get(key)));\n  }\n  return false;\n}\n"],"mappings":";;;;;;;;;;;;;;AAWA,MAAMA,6EAAmC,EAAE,aAAa,OAAO,CAAC;AAEhE,MAAM,aAAa;AACnB,MAAM,2BAA2B;AASjC,SAAS,eAAe,OAAuC;AAC7D,QAAO,UAAU,QAAQ,OAAO,UAAU;;AAG5C,SAAgB,aAAa,OAAuB;AAClD,+BAAkB,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;AAGzD,SAAgB,sBAAsB,WAA2B;CAC/D,MAAM,WAAW,aAAK,QAAQ,UAAU;AAExC,KAD4B,sBAAsB,KAAK,SAAS,CAE9D,QAAO;CAGT,MAAM,oBAAoB,aAAK,KAAK,UAAU,qBAAqB;CACnE,MAAM,kBAAkB,aAAK,KAAK,UAAU,kBAAkB;AAC9D,wBAAe,kBAAkB,CAC/B,QAAO;AAET,wBAAe,gBAAgB,CAC7B,QAAO;AAET,QAAO;;AAGT,SAAgB,uBAAuB,gBAA8B;AACnE,wBAAe,eAAe,CAAE;AAChC,mBAAU,aAAK,QAAQ,eAAe,EAAE,EAAE,WAAW,MAAM,CAAC;AAC5D,0BAAyB,gBAAgB,EAAE,CAAC;;AAG9C,eAAsB,iBAAiB,gBAAyC;AAC9E,SAAQ,MAAM,eAAe,eAAe,EAAE;;AAGhD,eAAsB,eAAe,gBAA8E;AACjH,wBAAuB,eAAe;AAEtC,0BAD6B,gBAAgB,QAAQ,CACzC,MAAM,KAAK,GACrB,QAAO;EACL,QAAQ,EAAE;EACV,gBAAgB;EACjB;CAGH,IAAI;AACJ,KAAI;AACF,iBAAe,MAAMA,OAAK,OAAgB,eAAe;UAClD,OAAO;AAId,uDAAa,iCAAiC,MAAM;AACpD,QAAM,IAAI,MACR,8BAA8B,eAAe,wSAC9C;;AAEH,KAAI,CAAC,eAAe,aAAa,CAC/B,OAAM,IAAI,MAAM,qBAAqB,eAAe,wEAAwE;CAG9H,MAAM,SAAS,aAAa;AAC5B,KAAI,WAAWC,yEACb,QAAO;EACL,QAAQ,EAAE;EACV,gBAAgB;EACjB;AAEH,KAAI,wDAAe,OAAO,CACxB,OAAM,IAAI,MAAM,qBAAqB,eAAe,GAAG;AAEzD,QAAO;EACL;EACA,gBAAgB;EACjB;;AAGH,SAAS,2BAA2B,gBAAwB,QAAwB;AAElF,4EAA+B,+EADkB,aAAK,QAAQ,eAAe,CAAC,CACzB;;AAGvD,SAAS,gBAAgB,gBAAwB,SAAuB;CACtE,MAAM,MAAM,aAAK,QAAQ,eAAe;AACxC,mBAAU,KAAK,EAAE,WAAW,MAAM,CAAC;CACnC,MAAM,WAAW,aAAK,KAAK,KAAK,iBAAiB,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM;AAC3F,uBAAc,UAAU,SAAS,QAAQ;AACzC,KAAI;AACF,qBAAW,UAAU,eAAe;UAC7B,OAAO;AACd,MAAI;AACF,kBAAO,SAAS;UACV;AACR,QAAM;;;AAIV,SAAS,yBAAyB,gBAAwB,QAAsB;AAC9E,iBAAgB,gBAAgB,2BAA2B,gBAAgB,OAAO,CAAC;;AAGrF,eAAsB,mBAAmB,gBAAwB,cAAqC;AACpG,wBAAuB,eAAe;AAEtC,KAAI,oBAAoB,aAAa,CAAC,WAAW,EAAG;CAEpD,MAAM,+BAAuB,gBAAgB,QAAQ;CAIrD,MAAM,eAAe,gCAAgC,SAAS,eAAe;AAC7E,KAAI,gBAAgB,+DAAsB,aAAa,EAAE;EACvD,MAAM,2DAAkB,cAAc,aAAa;AACnD,MAAI,wDAAe,OAAO,CACxB,OAAM,IAAI,MAAM,GAAG,WAAW,qDAAqD,iBAAiB;AAEtG,2BAAyB,gBAAgB,OAAO;AAChD;;CAKF,MAAM,iBAAiB,MAAM,2BAA2B,eAAe;CACvE,MAAM,EAAE,WAAW,SAAS,oBAAoB,gBAAgB,QAAQ;AACxE,KAAI;AACF,QAAM,qBAAqB;GACzB,QAAQ,wBAAwB,aAAK,SAAS,eAAe,EAAE,cAAc,eAAe;GAC5F,KAAK,aAAK,QAAQ,eAAe;GACjC,mBAAmB,aAAa,wBAAwB,WAAW,UAAU,KAAK;GACnF,CAAC;AACF,QAAM,oBAAoB,gBAAgB,gBAAgB,cAAc,UAAU;UAC3E,OAAO;AACd,MAAI;AACF,sBAAmB,UAAU;WACtB,cAAc;AACrB,WAAQ,MAAM,GAAG,WAAW,mEAAmE,eAAe,yDAAyD;IACrK;IACA,cAAc,wBAAwB,QAAQ,aAAa,UAAU,OAAO,aAAa;IAC1F,CAAC;;AAEJ,QAAM;;;AAIV,eAAsB,oBAAoB,gBAAwB,QAA+B;AAC/F,0BAAyB,gBAAgB,OAAO;;AAGlD,eAAe,qBAAqB,SAIlB;CAChB,MAAM,YAAY,qBAAqB;CACvC,MAAM,0CAA0B,IAAI,KAAa;AACjD,KAAI;AACF,sDAA6B;GAC3B,QAAQ,QAAQ;GAChB,KAAK,QAAQ;GACb,cAAc;IAAC;IAAQ;IAAS;IAAQ;IAAQ;IAAO;GACvD,iBAAiB;GACjB;GACA,SAAS,SAAS;AAAE,YAAQ,KAAK,GAAG,WAAW,WAAW,OAAO;;GACjE,eAAe,UAAU;IACvB,MAAM,uDAAgC,MAAM,WAAW,MAAM,YAAY,QAAQ,IAAI;AACrF,QAAI,UAAU,KAAM,QAAO,EAAE,UAAU,MAAM;AAC7C,QAAI,wCAAiB,QAAQ,KAAK,OAAO,EAAE;AACzC,6BAAwB,IAAI,OAAO;AACnC,YAAO,EACL,oBAAoB;MAClB,eAAe;MACf,oBAAoB;MACpB,0BAA0B,sBAAsB,OAAO;MACxD,EACF;;AAEH,YAAQ,mBAAmB,OAAO;AAClC,WAAO,EAAE,UAAU,MAAM;;GAE5B,CAAC;UACK,OAAO;AACd,MAAI,iBAAiBC,0CACnB,OAAM,IAAI,MAAM,uCAAuC,UAAU,4DAA4D;AAE/H,MAAI,iBAAiBC,0CACnB,OAAM,IAAI,MAAM,GAAG,MAAM,QAAQ,yDAAyD;AAE5F,QAAM;;AAER,KAAI,wBAAwB,OAAO,EACjC,OAAM,IAAI,MAAM,uCAAuC,wBAAwB,KAAK,+DAA+D,CAAC,GAAG,wBAAwB,CAAC,KAAK,KAAK,CAAC,+BAA+B;;AAI9N,SAAS,sBAA8B;CACrC,MAAM,MAAM,QAAQ,IAAI;AACxB,KAAI,OAAO,QAAQ,IAAI,MAAM,KAAK,GAAI,QAAO;CAC7C,MAAM,SAAS,OAAO,IAAI;AAC1B,KAAI,CAAC,OAAO,SAAS,OAAO,IAAI,UAAU,EACxC,OAAM,IAAI,MAAM,iDAAiD,KAAK,UAAU,IAAI,CAAC,+CAA+C;AAEtI,QAAO;;AAGT,SAAS,wBAAwB,WAAiC,UAAkB,MAAyB;CAC3G,MAAM,WAAW,aAAK,QAAQ,SAAS;AACvC,KAAI,KAAK,IAAI,SAAS,CAAE;AACxB,MAAK,IAAI,SAAS;AAClB,WAAU,KAAK;EAAE,MAAM;EAAU,4BAAoB,SAAS,wBAAgB,UAAU,QAAQ,GAAG;EAAM,CAAC;;AAG5G,SAAS,oBAAoB,gBAAwB,eAA+E;CAClI,MAAM,MAAM,aAAK,QAAQ,eAAe;CACxC,MAAM,iBAAiB,aAAK,QAAQ,eAAe;CACnD,MAAM,YAAkC,CAAC;EAAE,MAAM;EAAgB,SAAS;EAAe,CAAC;CAC1F,MAAM,OAAO,IAAI,IAAY,CAAC,eAAe,CAAC;AAC9C,MAAK,MAAM,aAAa,4BAA4B,cAAc,EAAE;EAClE,MAAM,WAAW,aAAK,QAAQ,KAAK,UAAU;AAC7C,MAAI,wCAAiB,KAAK,SAAS,CAAE;AACrC,0BAAwB,WAAW,UAAU,KAAK;;AAEpD,QAAO;EAAE;EAAW;EAAM;;AAG5B,SAAS,mBAAmB,WAAuC;CACjE,MAAM,WAAqB,EAAE;AAC7B,MAAK,MAAM,EAAE,MAAM,UAAU,aAAa,UACxC,KAAI;AACF,MAAI,YAAY,MACd;0BAAe,SAAS,CAAE,gBAAO,SAAS;QAE1C,uBAAc,UAAU,SAAS,QAAQ;UAEpC,OAAO;AACd,WAAS,KAAK,GAAG,SAAS,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GAAG;;AAG3F,KAAI,SAAS,SAAS,EACpB,OAAM,IAAI,MAAM,qBAAqB,SAAS,OAAO,4BAA4B,SAAS,KAAK,KAAK,GAAG;;AAI3G,eAAe,2BAA2B,gBAAgD;AACxF,KAAI;AACF,UAAQ,MAAM,eAAe,eAAe,EAAE;UACvC,OAAO;AACd,UAAQ,KAAK,GAAG,WAAW,2FAA2F;GACpH;GACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC9D,CAAC;AACF,SAAO;;;AAIX,eAAe,oBAAoB,gBAAwB,gBAA+B,cAAsB,WAAgD;AAC9J,KAAI,kBAAkB,MAAM;EAC1B,MAAM,SAAS,qEAA4B,gBAAgB,aAAa,CAAC;AAEzE,MAAI,CAAC,aADU,oBAAoB,MAAM,eAAe,eAAe,EAAE,OAAO,EACtD,OAAO,CAC/B,OAAM,IAAI,MAAM,uCAAuC,eAAe,qEAAqE;AAE7I;;AAWF,KAAI,oBAAoB,aAAa,CAAC,SAAS,KAAK,CAAC,uBAAuB,UAAU,CACpF,SAAQ,KAAK,GAAG,WAAW,qCAAqC,eAAe,2CAA2C;AAI5H,KAAI,CAAC,6CADwB,gBAAgB,QAAQ,EACf,eAAe,CACnD,OAAM,IAAI,MAAM,uCAAuC,eAAe,0DAA0D;;AAIpI,SAAS,gCAAgC,SAAiB,gBAAuC;AAC/F,KAAI;EACF,MAAM,oFAAwC,SAAS,eAAe;AACtE,gEAAqB,OAAO,GAAG,SAAS;SAClC;AACN,SAAO;;;AAIX,SAAS,wBAAwB,SAAiB,gBAAiC;AACjF,KAAI;AACF,6EAA+B,SAAS,eAAe;AACvD,SAAO;SACD;AAIN,SAAO,8BAA8B,KAAK,QAAQ;;;AAItD,SAAS,4BAA4B,SAA2B;CAC9D,MAAM,aAAuB,EAAE;CAC/B,MAAM,gBAAgB;CACtB,IAAI;AACJ,SAAQ,QAAQ,cAAc,KAAK,QAAQ,MAAM,KAC/C,YAAW,KAAK,MAAM,GAAG;AAE3B,QAAO;;AAGT,SAAS,uBAAuB,WAA0C;AACxE,QAAO,UAAU,MAAM,EAAE,MAAM,UAAU,cAAc;AAErD,6BAD2B,SAAS,wBAAgB,UAAU,QAAQ,GAAG,UACtD;GACnB;;AAGJ,SAAS,oBAAoB,QAAgC;CAC3D,MAAM,UAA0B,EAAE;CAClC,MAAM,QAAQ,QAAgB,QAAsB;AAClD,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,EAAE;GAC9C,MAAM,WAAW,WAAW,KAAK,MAAM,GAAG,OAAO,GAAG;AACpD,OAAI,UAAU,OAAW;AACzB,OAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC,SAAS,EACtG,MAAK,UAAU,MAAM;OAErB,SAAQ,KAAK;IAAE,MAAM;IAAU;IAAO,CAAC;;;AAI7C,MAAK,IAAI,OAAO;AAChB,QAAO;;AAGT,SAAS,wBAAwB,gBAAwB,cAAsB,gBAAuC;CAEpH,MAAM,cADU,oBAAoB,aAAa,CACrB,KAAK,EAAE,MAAM,YAAY,YAAY;AAC/D,SAAO,KAAK,KAAK,UAAU,WAAW,CAAC,WAAW,KAAK,UAAU,MAAM;GACvE,CAAC,KAAK,KAAK;CACb,MAAM,iBAAiB,kBAAkB,OAAO,OAAO,qEAA4B,gBAAgB,aAAa,CAAC;CACjH,MAAM,wBAAwB,kBAAkB,OAAO,KAAK;;;EAG5D,KAAK,UAAU,gBAAgB,MAAM,EAAE,CAAC;;AAGxC,QAAO;;eAEM,KAAK,UAAU,eAAe,CAAC;;;;;;;;;EAS5C,YAAY;EACZ,sBAAsB;;;;;;;;;AAUxB,SAAS,mBAAmB,QAAkC;CAC5D,MAAM,cAAwB,EAAE;CAChC,MAAM,gEAAuB,QAAQ;EACnC,oBAAoB;EACpB,eAAe;EACf;EACD,CAAC;AACF,KAAI,YAAY,SAAS,EACvB,OAAM,IAAI,MAAM,kFAAkF,YAAY,KAAK,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG;AAE/J,QAAO;;AAGT,SAAS,aAAa,GAAY,GAAqB;AACrD,KAAI,MAAM,EAAG,QAAO;AACpB,KAAI,MAAM,QAAQ,MAAM,KAAM,QAAO,MAAM;AAC3C,KAAI,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ,EAAE,EAAE;AACxC,MAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAC5E,SAAO,EAAE,OAAO,OAAO,UAAU,aAAa,OAAO,EAAE,OAAO,CAAC;;AAEjE,KAAI,OAAO,MAAM,YAAY,OAAO,MAAM,UAAU;EAClD,MAAM,WAAW,OAAO,QAAQ,EAAE;EAClC,MAAM,OAAO,IAAI,IAAI,OAAO,QAAQ,EAAE,CAAC;AACvC,MAAI,SAAS,WAAW,KAAK,KAAM,QAAO;AAC1C,SAAO,SAAS,OAAO,CAAC,KAAK,WAAW,KAAK,IAAI,IAAI,IAAI,aAAa,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC;;AAE9F,QAAO"}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@hexclave/shared-backend",
+  "version": "1.0.17",
+  "repository": "https://github.com/hexclave/hexclave",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": {
+        "default": "./dist/index.js"
+      },
+      "default": "./dist/esm/index.js"
+    },
+    "./config-agent": {
+      "types": "./dist/config-agent.d.ts",
+      "require": {
+        "default": "./dist/config-agent.js"
+      },
+      "default": "./dist/esm/config-agent.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.test.*",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "^0.2.73",
+    "jiti": "^2.4.2",
+    "@hexclave/shared": "1.0.17"
+  },
+  "devDependencies": {
+    "@types/node": "20.17.6",
+    "typescript": "5.9.3"
+  },
+  "scripts": {
+    "build": "rimraf dist && tsdown",
+    "clean": "rimraf dist && rimraf node_modules",
+    "dev": "tsdown --watch",
+    "lint": "eslint --ext .tsx,.ts .",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}